log format:
start: A
End: A
start: B
End: B
Start: C
Start: D
End: C
End: D
Start:E
End:F
Query I am using:
| rex field=_raw "END:(?.*)"
| transaction processEndName startswith="Start:" endswith="END:" keeporphans=false keepevicted=false
| sort -duration
| head 10
| stats avg(duration) by processEndName
In the return:
A and B can be group together correctly as:
startA
endA
startB
endB
But C and D are messed up:
startD
endC
also E only has starts, F only has ends, but their process name is different, they got grouped together as well:
startE
endF
Is there a way to properly group C/D and exclude E and F?
Thanks in advance!
Well, I think you are extracting only END process name, you need to extract START as well. As A,B,C,D,so on is your common values(Process names) which will be in both START and END.
Also, put your code in 101010
sample format so that query will display correctly.
well You query is looking absurd so can not give you correct regex but you can try something like this
(END|START):(?<processname>.*)
let me know if this helps!
Well, I think you are extracting only END process name, you need to extract START as well. As A,B,C,D,so on is your common values(Process names) which will be in both START and END.
Also, put your code in 101010
sample format so that query will display correctly.
well You query is looking absurd so can not give you correct regex but you can try something like this
(END|START):(?<processname>.*)
let me know if this helps!
Thanks man, it works!
Not sure why the query did not display correctly
I got processEndName from the following query
| rex field=_raw "END:(?.*)"