Hello,
I hope there is someone who can help me solve this problem.
I'd like to know how to group events shown as follow.
Currently my log looks like this:
time ........... code
1.1.2009 .... A
1.2.2009 .... A
1.3.2009 .... B
1.4.2009 .... A
1.5.2009 .... B
1.6.2009 .... B
1.7.2009 .... B
What I want to get is something like this:
time ........... code
1.1.2009 .... A
1.3.2009 .... B
1.4.2009 .... A
1.5.2009 .... B
The task would be to group events as long as they have the same code and to start a new group if there is some other value in code. I tried to solve this problem with transaction
and startswith
and endswith
but in my log there are many more different codes then in this example, so I don't know how to use it. Who can help me?
Thank you
Try something like this
your base search giving _time and code fields | streamstats current=f window=1 first(code) as prevcode | where isnull(prevcode) OR code!=prevcode
Try something like this
your base search giving _time and code fields | streamstats current=f window=1 first(code) as prevcode | where isnull(prevcode) OR code!=prevcode
Exactly what I needed, thank you so much..