I have two searches and I am trying to join start and stop post based on event name. Problem is event name could be the same so ”stats first(*) as * by Event_same_name” is not working for me.
I have sorted the table based on time, so I know the start and stop is in chronicle and correct order
Table:
Event_same_name Start_epoch Stop_epoch
Event time_A
Event time_B
Event time_C
Event time_D
Event time_E
Event time_F
Output:
Event_same_name Start_epoch Stop_epoch
Event time_A time_B
Event time_C time_D
Event time_E time_F
@dukie,
Try
"your search to sort events" |eval rowno=1|accum rowno
|streamstats current=f window=1 last(_time) as Start_epoch|where rowno%2==0|rename _time as Stop_epoch|fields - rowno
Start event which does not have an end event is neglected here.
@dukie,
Try
"your search to sort events" |eval rowno=1|accum rowno
|streamstats current=f window=1 last(_time) as Start_epoch|where rowno%2==0|rename _time as Stop_epoch|fields - rowno
Start event which does not have an end event is neglected here.