Querying the same attribute with two conditions

Typically I would write this as a subquery in an “IN” clause, but that doesn’t seem to be supported currently. I have written two queries with results, similar to below:

Select * From Transaction where appName = ‘AppName1’ and request.uri = URI1

TransactionID|appName |traceId
1 AppName1 trace1
2 AppName1 trace2

Select * From Transaction where appName = ‘AppName2’ and request.uri = URI2

TransactionID|appName |traceId
2 AppName2 trace2
3 AppName2 trace3

(Ignore the missing columns, they are present just not pertinent to this question)
My question is, is there a query that can be written in order to return just the result of TransactionID2? Basically, I want a query that returns results where the traceId is the same between app1 and app2. I’ve looked at nested aggregation but from what I can tell, it won’t really work when you have two different conditions for the same attribute field in a single event (ex. two different appNames and two different URIs in the Transaction event like I do). So that doesn’t seem to work unless someone can educate me?

I will also add that I will want to do a count on the number of traceIds that are similar. Because I did use the dashboard filtering function to be able to somewhat see the results but using the dashboard filtering didn’t allow me to see mass results easily (I can filter by each and every traceID but that takes hours to verify with the amount of data) and doesn’t allow for me to do a count on it.


Welcome to our Explorers Hub!

I’m wondering if you have checked the event TransactionTrace?

Let me know if you have any doubts