Here is my original Jboss search string variables:
index=bob
CLASS="bobclass"
MESSAGE="bobmessage1"
MESSAGE="bobmessage2"
TRANSACTION
I am trying to make a dashboard that will show me the results when a user gets two particular jboss messages within the same transaction. I am thinking about starting the search on the CLASS, sort by TRANSACTION and if both MESSAGEs are in the particular TRANSACTION then that will count as a successful user transaction.
index=bob CLASS="bobclass"|sort by TRANSACTION
But from here I am at a loss how to sort it out.
Give this a try
index=bob CLASS="bobclass" MESSAGE="bobmessage1" OR MESSAGE="bobmessage2" TRANSACTION
| stats values(MESSAGE) as MESSAGE by TRANACTION userFieldName | where mvcount(MESSAGE)=2