I have a log which is tracking objects as they get moved around by a state machine. The log records a timestamp, the GUID of the object that was moved and the to and from states for the object.
When the state machine moves object to state=foo, this is the beginning of the transaction I want to see. Then the object will then cycle between states foo and bar for some time. Eventually they leave state=foo and go to a state other than foo or bar. That is the end of the transaction.
This is the search that I wrote. When I look at these transactions I'm not seeing what I expected. Am I doing this correctly?
transaction ObjectGUID startswith(ToState=foo AND FromState!=bar) endswith(FromState=foo AND ToState!=bar)
Got it. Thanks!
You're missing equal signs. startswith
and endswith
options need to be followed by =
Example dataset:
Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc
Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc
Tue Nov 26 19:25:57 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:25:58 EST 2013 ToState=baz objectGUID=abc
Tue Nov 26 19:25:59 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:26:00 EST 2013 ToState=baz objectGUID=abc
Tue Nov 26 19:26:01 EST 2013 ToState=qux objectGUID=abc
Tue Nov 26 19:26:02 EST 2013 ToState=baz objectGUID=abc
index=main | transaction objectGUID startswith=(ToState=foo AND FromState!=bar) endswith=(FromState=foo AND ToState!=bar)
Results:
Tue Nov 26 19:25:51 EST 2013 ToState=foo FromState=qux objectGUID=abc
Tue Nov 26 19:25:52 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:53 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:54 EST 2013 ToState=bar objectGUID=abc
Tue Nov 26 19:25:55 EST 2013 ToState=foo objectGUID=abc
Tue Nov 26 19:25:56 EST 2013 ToState=baz FromState=foo objectGUID=abc
Hi Craig, it your question was answered, please check the "accept" icon, it will help the other user to find useful information and reward the person that answered.
Got it. Thanks!