Grouping log events to show uplink and down link traffic

[nrelihan]

Hey,
I would like to couple two events together that would show the uplink and downlink traffic.
These two events would be in different location in the logs, depending on how long it takes the events to occur.

"10.159.216.131","61096/UDP","10.4.4.34","53/UDP (DNS)","Serial2/0.101","GigabitEthernet0
"10.4.4.34","53/UDP (DNS)","10.159.216.131","61096/UDP","GigabitEthernet0/1","Serial2

I have tried using the transaction funtion, to no avail, any suggestions on how this would be achieved?

Thanks alot.

Neil

[bobbyfaber]

Maybe you can give us some more detail? Have you named these fields?
It appears that if the port number (61096/UDP) is extracted in both cases (perhaps as 'port') one could do:

transaction port

or

stats port

Depending on the rest of the data, some other massaging may be needed.

[nrelihan]

Yeah sorry, the first and second IP addresses are parsed as src and dst IPs. The "61096/UDP" field as src_port and 53/UDP (DNS) as dst_port.
The problem with doing "transaction dst_port src_port" for instance is that it comes back with multiple events that posses these fields, but what I require is to have the uplink and down link grouped together.
Cheers