Transaction Query Help
I'm unable to get counts for each aliased transaction. Query listed below. Counts continue to show up under "other", an alias I never created.
_source=*
|transaction on msg
with "Did tap wake *" as wake_tapped,
with "Did receive system wake started*" as wake_started,
with "Waiting for launch group 0 *" as wait_g0,
with "Waiting for launch group 1 *" as wait_g1,
with "Waiting for launch group 2 *" as wait_g2,
with "Waiting for launch group 3 *" as wait_g3,
with "Waiting for launch group 4 *" as wait_g4,
with "Waiting for launch group 5 *" as wait_g5,
with "System wake triggered successfully" as wake_success,
with "Did receive system wake error *" as wake_error
results by transactions showing max(_messagetime),
sum("1") for wake_tapped as wake_count
Please sign in to leave a comment.
Comments
0 comments