My question is a mix of using the transaction command with the bin command.
What I would like to achieve is capturing when 2 consecutive POST requests are made in proxy logs within two seconds of each other. Straight up `using | _bin span=2s` misses out on events that might happen during odd seconds.
Essentially, I want the two second timer to start when the first event occurs, and then looks for the next event (another POST request), within two seconds.
Is there a feasible way to achieve what I'm asking for? Or am I not making much sense?
↧
