Refine your search:

I have two different kinds of events. I would like to relate the two. The first event looks like this.

[2012-02-02 20:17:51,931] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushNotificationReceived externalSignInStatus=true

The second looks like this.

[2012-02-02 20:18:03,050] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushCompleted startedBackgroundDownload=true

I would like to find all the sessionIds where startedBackgroundDownload=false from the second event and externalSignInStatus=true from the first event.

I think I would be able to do this with a subsearch, but nothing I've tried has resulted in anything but 0 matching events. Can anyone help me with a subsearch that would do what I need?

asked 03 Feb, 17:31

mburbidg's gravatar image

mburbidg
113
accept rate: 0%

closed 04 Feb, 00:20

Ayn's gravatar image

Ayn
9.6k1315

The question has been closed for the following reason "Duplicate Content" by Ayn 04 Feb, 00:20


One Answer:
link

answered 03 Feb, 21:27

Damien%20Dallimore's gravatar image

Damien Dalli...
2.6k17
accept rate: 21%

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×131

Asked: 03 Feb, 17:31

Seen: 324 times

Last updated: 04 Feb, 00:20

Copyright © 2005-2012 Splunk, Inc. All rights reserved.