I have these set of event based on transaction But I only want to compute a specific sequence of events and discard the rest.
Here is the criteria for the sequence of what I want to capture.
hi michaelrosello,
filter events before and after transaction, something like this:
index=my_index (page=pageDefault OR page=pageChange OR page=listRead)
| transaction startswith="pageDefault "
| search page=pageChange page=listRead
| table _time url page response_time
Bye.
Giuseppe
Do you want to go from one pageDefault
to the next pageDefault
, but only those ending with listRead
? And that would mean that the first four pageDefault
entries would be thrown out. Or do you want to go from the first pageDefault
through to at least the last in the set of listRead
entries? That will make a big difference.
There should only be one set of events that I should capture. So based on my screenshot. the sequence of pageDefault,pageChange,pageChange,listRead,listRead,listRead will be computed and the rest thrown out.