Hello,
I'm trying to get the duration of a transaction starting with "green" and stopping with "red" :
The problem is that when i have data like this :
The calculated duration is ko because of the duplicated events.
This is my search query :
host="Data_Host" "Connected"
| rex ="Host (?
| transaction host startswith="*Green" endswith="Red"
| stats sum(duration) as "uptime_duration" by ligneNum
| convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration"
| fieldformat uptime_duration=tostring(uptime_duration,"duration")
I want my transactions to ignore the same redondant successif colors.
the result should be something like :
- time_001 Green
- time_003 Red
- time_005 Green
- time_006 Red
- time_007 Green
- time_009 Red
Hello,
I already tested : dedup color
But the result is not what i expected.
can you give more informations about dedup filters ?
I doubt if this is the most elegant way, it may not even be a correct way (reading the documentation dedup should keep the most recent event) but using reverse prior to the dedup seems to keep the events you want (if time_001 is earlier than time_002).
Try something like
...
| rex ="Host (?
| reverse
| dedup color consecutive=t
| sort -_time
| transaction host startswith="Green" endswith="Red*"
| ...
Dave
try dedup; a filtering command for removing redundunt data that match specific criteria