Funnel using trace.id

Hi, trying to find where the logs grouped by trace.id have one set of text as a message, but are missing another. Starting by trying to find all trace.ids that have both messages, thinking a funnel is the way. But not getting any data back, possibly because I’m not getting the first param correct.

SELECT funnel(trace.id, where message like ‘Entering CDBDAO.setCreditDecision DealCreditDecisionData retrieved’ as ‘Entered’, where message like ‘Exiting CDBDAO.setCreditDecision’ as ‘Left’) from log since 2 weeks ago

Do you have any parsing rules for your logs?

No, is that something that I should explore? To be clear, the “Enter” will be one log, the “Exit” another.

Thanks,
Jim

Do parsing rules allow you to set or clear flags / custom variables? That would be cool.

I’m not sure how you are looking at that, but parsing rules take your unstructured log statements and transform them into attribute value pairs. If you don’t have that a lot of the NRQL is pretty difficult to use.