My question is a mix of using the transaction command with the bin command.
What I would like to achieve is capturing when 2 consecutive POST requests are made in proxy logs within two seconds of each other. Straight up using | _bin span=2s
misses out on events that might happen during odd seconds.
Essentially, I want the two second timer to start when the first event occurs, and then looks for the next event (another POST request), within two seconds.
Is there a feasible way to achieve what I'm asking for? Or am I not making much sense?
when you say consecutive, do you mean that there is no other events in between those 2 POST events?
can you share some masked data sample?