I want to track a single transaction through three different events.
Event A and Event B share a common field f1 which links the events as a transaction
Event B and Event C share a common field f2 which links the events as a transaction
Event A does not contain f2.
Event C does not contain f1
I have a search like the following
event=A OR event=B OR event=C
| transaction f1 maxspan=2s keeporphans=true keepevicted=true
| transaction f2 maxspan=2s
| table f1 f2 other_field_unique_to_A other_field_unique_to_B other_field_unique_to_C
Events of type A and B are joined exactly how I like - on field f1. Their unique fields appear together on the same line of the output table.
In the output table, I can see all the events of type C, but none of them are ever joined in to the corresponding transactions of type A and B.
What can be done here?
Give this a try
event=A OR event=B OR event=C
| eventstats values(f1) as f1_temp by f2 | eval f1=coalesce(f1,f1_temp)
| eventstats values(f2) as f2_temp by f1 | eval f2=coalesce(f2,f2_temp)
| stats values(uniqfield1) as uniqfiel1 values(uniqfield2) as uniqfield2.... by f1 f2