I did the following search to identify those "A" events that are not paired/ends with "B" events.
"A" OR "B" | transaction startswith="A" endswith="B" keepevicted=true | search closed_txn=0 "A"
When I clicked on "show source" and got the following error messages:
"Could not find target event on the remote server, unable to form the proper distributed search"
I noticed that I always get this same error message when "show source" after using the transaction function. I like to view/show the source around the starting event in a transaction, is there a workaround?
I have a workaround solution. Assume A won't happen twice within 1s span. I use the transaction & subsearch as follows:
"A" [search "A" OR "B" | transaction startswith="A" endswith="B" keepevicted=true | search closed_txn=0 "A" | eval earliest=_time | eval latest=relative_time(_time, "+1s") | fields host, earliest, latest | format "(" "(" "" ")" "OR" ")"]
Basically I used subsearch to convert transaction results into search results, then I can show source.
Any more elegant solutions are welcome.
I have a workaround solution. Assume A won't happen twice within 1s span. I use the transaction & subsearch as follows:
"A" [search "A" OR "B" | transaction startswith="A" endswith="B" keepevicted=true | search closed_txn=0 "A" | eval earliest=_time | eval latest=relative_time(_time, "+1s") | fields host, earliest, latest | format "(" "(" "" ")" "OR" ")"]
Basically I used subsearch to convert transaction results into search results, then I can show source.
Any more elegant solutions are welcome.