In the "transaction" documentation (https://service.sumologic.com/help/Default.htm#Transaction_operator.htm%3FTocPath%3DSearch|Transaction%2520Analytics|_____0 ), one of the examples uses a "showing" parameter which is, as far as I can tell, not documented anywhere else:
... | transaction on sessionid
with "Starting session *" as init,
with "Initiating countdown *" thresh=2 as countdown_start,
with "Countdown reached *" thresh=2 as countdown_done,
with "Launch *" as launch
results by transactions showing max(_messagetime),
sum("1") for init as initcount
What does this "showing" operator do, and can it be added to a future version of the documentation?
Please sign in to leave a comment.