Page Comparison

* in log.audit | trix trix.uniqueIds.fields = (user)

user column as a unique key - mandatory

* in log.audit | trix trix.uniqueIds.fields = (user) trix.uniqueSubIds.fields = (pid)

pid column as an optional unique key

* in log.audit | trix trix.uniqueIds.fields = (user) trix.uniqueSubIds.fields = (pid) cep.name=(session id)

The name for each complex event will be determined by the session id value

* in log.audit | trix trix.uniqueIds.fields = (user) trix.uniqueSubIds.fields = (pid) cep.name=(session id) cep.groups=(session id)

groups list will be determined by the session id values

* in log.audit | trix trix.uniqueIds.fields = (user) trix.uniqueSubIds.fields = (pid) cep.name=(session id) cep.groups=(session id) type=(thread)

types list will be determined by the thread values

cep.time > 10000 * in log.audit 

| trix trix trix trix.uniqueIds.fields = (user) | where cep.time < 10000

Trix events that took more than 10 seconds (time is in milliseconds)

* in log.audit 

| trix trix.uniqueIds.fields = (user) | avg cep.time as Average, min cep.time as Min, max cep.time as Max | display Average in time format, Min in time format, Max in time format

Average, Minimum and Maximum time of the Trix events

* in log.audit | 

trix trix.uniqueIds.fields = (user) cepNode.timeframe.limit = (5 seconds)

The complex event will be closed after limit-Time has expired

* in log.audit | 

trix trix.uniqueIds.fields = (user) cepNode.event.timeframe.limitFromStart = (10 minutes)

Only events which are less than limitTimeFromStart from the first event will be added to the transaction.

* in log.audit | trix trix.uniqueIds.fields = (user) cepNode.maxEventLimit=3

Max number of events for each complex event

* in log.audit | trix trix.uniqueIds.fields = (user) startRule = (Event Description contains session has started) endRule = (Event Description contains was terminated)

Start and End conditions.

To filter only the ceps which stand by the start and end conditions, add the following:

 | where hasstartevent = true and hasendevent = true

* in log.audit | trix trix.uniqueIds.fields = (user) cepNode.timeframe.limit = (5 seconds)

The complex event will be closed after limit-Time has expired

* in log.audit | trix trix.uniqueIds.fields = (user) cepNode.event.timeframe.limitFromStart = (10 minutes)

Only events which are less than limitTimeFromStart from the first event will be added to the transaction.

enrichments.pid.first = (pid)

enrichments.pid.all = (context)

enrichments.<name>.<type> - allows adding additional columns to the meta of the cep.

name - the name of the output column to use.

type - the type of the extraction, currently can be ‘first’ (extracts the first value it encounters) or ‘all’ (extracts all values) - optional