So I have a search that is structured as follows
index=main <filtering for start and end events> OR <filtering for events within start and end events> | rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..." | transaction startswith="..." endswith="..."
The rex fields work, the transaction works, etc. However, In the events within the transaction, it pulls from every host that fits the filtering. Basically, I want to limit the transaction to only include the hosts that are listed in the Falling_Node and Rising_Node fields. I've tried adding "host=Falling_Node OR host=Rising_Node" in the "filtering for events within start and end events" but it either clears all events out of the transaction or does nothing.
Does anyone have tips?
You can tell the transaction command to use fields when matching up events. Something like this
index=main <filtering for start and end events> OR <filtering for events within start and end events>
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..."
| transaction Rising_Node, Falling_Node startswith="..." endswith="..."
That would be a good solution, however only one event (the last event) in my transactions actually contain the fields "Rising_Node" and "Falling_Node". That means that I can't sort the transaction like you mentioned because it would never find the "startswith" event to make the transactions. Do you have any alternative solutions?
Perhaps this?
index=main <filtering for start and end events> OR <filtering for events within start and end events>
| rex field=_raw "...<Rising_Node>..." | rex field=_raw "...<Falling_Node>..."
| where (host=Rising_Node OR host=Falling_Node)
| transaction startswith="..." endswith="..."
@richgalloway Unfortunately that didn't work either and it returns no results.