Perform a pattern check: after one API call, immediately verify the next API call and, for a specified API, extract the result

[kumarv14]

we have attach image of our result but we wants to check in single query -:

after one API call, check the next API call; for a specific API, extract the result of the subsequent API.

we want to count how many IMSIs have DNIRealTimeMessage but never get AcquireConfiguration afterward (and also list those IMSIs) . initially i have try join but not getting expected result .

fetch logs, scanLimitGBytes:-1
| filter dt.system.bucket=="custom_l_" and index == "_db"

| filter Market=="marketname"
|filter IMSI =="0073412"
| filter TransactionType =="DNIRealTimeMessage" and TransactionType "AcquireConfiguration"
|fields content,TransactionType

[krzysztof_hoja]

Is there anything in content or anywhere else in the records which acts as correlate id or transaction id, connecting DNIRealTimeMessage with corresponding AcquireConfiguration (this also means that no 2 DNIRealTimeMessage rows have the same value)? or maybe IMSI play this role?

[kumarv14]

I am checking if we have any sessionID or track ID for these sequences API will try to enable debug log.