My question is a mix of using the transaction command with the bin command. What I would like to achieve is capturing when 2 consecutive POST requests are made in proxy logs within two seconds of each other. Straight up using | _bin span=2s misses out on events that might happen during odd seconds. Essentially, I want the two second timer to start when the first event occurs, and then looks for the next event (another POST request), within two seconds. Is there a feasible way to achieve what I'm asking for? Or am I not making much sense.
↧