I'm trying to find points in time where a consecutive event happens 5 times in a row.
I currently have this query:
partner_id=9991| streamstats count BY timeout reset_on_change=true | table timeout, count, _time
But it shows both timeout combinations and their increasing count.
Can't you just add | where count==5
?
@isvaljek ,
If you just want one event where number equals 5 use |where count=5
partner_id=9991| streamstats count BY timeout reset_on_change=true | table timeout, count, _time|where count=5
If you want all the events which are contributing to the consecutive events (ie, event 1 to event 5(n)), try below
partner_id=9991|streamstats last(timeout) as prev window=1 current=f|eval flag=if(timeout==prev OR isnull(prev),0,1)
|accum flag|eventstats count by flag|where count>=5