I am using the below query, but i need to omit the transactions unless the URLs are different in the transaction.
index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | transaction sessionID maxspan=3s
Thanks.
Your URLs likely are stored in a multi-value field, so you can exploit that to filter:
... | where mvcount(URL) > 1
Alternatively, if you have to make sure two specific URLs are present, you can again use the multi-value property to filter like this:
... | search URL="/bankapi/session" URL="/bankapi/accounts"
Note, that's using an implicit AND instead of OR... both will yield true for the transactions you want because the MV field contains both values.
It would be helpful if you can post some sample events and your expected output of transaction command.
Try this
index=olb_logs sourcetype="access-API" (URL="/bankapi/session" method=POST ) OR (URL="/bankapi/accounts" method=GET) | dedup URL| transaction sessionID maxspan=3s
even this is not giving me accurate results.
Thanks a lot, for the response.