I have logs with three fields (1) session_id, (2) login_id, (3) message
- session_id is "key"
- login_id is empty except user first login
e.g.
session_id,login_id,message
session1, loginA, message1
session1,, message2
session1,, message3
session2,loginB, message4
How to join the data to retrieve all events and fields of "sesion1" only using login_id="loginA"?
You can use the transaction command.
Your search | transaction startswith="login_id='loginA'" endswith="Whatever the last bit of it is"
This will join the string together as one event.
The transaction command will merge contents into a single row. But I want the result is shown as below table format. Can do it?
time,session1,loginA,message1
time,session1,loginA,message2
time,session1,loginA,message3
If you want to display it as a table, simply use the table command.