You could use streamstats to define an identifier for each iteration. If, for example, the cycle is terminated by the Data Processing Phase -1 completed, then you can use streamstats to define the iteration count based on that occurring, e.g. this example | makeresults
| eval data=split(replace("
2023-02-16T16:14:04: Data Processing Phase -1 completed
2023-02-16T14:01:00: Data Processing Phase -1 starting
2023-02-16T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed
2023-02-16T11:34:10: Data Collection Phase 2 starting
2023-02-16T11:34:10: Data Collection Phase 1 completed
2023-02-16T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting
2023-02-16T11:34:10: Data Collection Phase 2 completed
2023-02-16T09:01:36: Data Collection Phase 1 starting
2023-02-15T16:14:04: Data Processing Phase -1 completed
2023-02-15T14:01:00: Data Processing Phase -1 starting
2023-02-15T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed
2023-02-15T11:34:10: Data Collection Phase 2 starting
2023-02-15T11:34:10: Data Collection Phase 1 completed
2023-02-15T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting
2023-02-15T11:34:10: Data Collection Phase 2 completed
2023-02-15T09:01:36: Data Collection Phase 1 starting", "\n", "##"), "##")
| mvexpand data
| eval _time=strptime(data, "%FT%T")
| rex field=data ": (?<Phase>Data (Processing|Collection) Phase) (?<PhaseIdentifier>-?\d+) (?<state>.*)"
| streamstats count(eval(if(PhaseIdentifier=-1 AND state="completed", 1, null()))) as iteration
| stats first(_time) as End, last(_time) as Start by iteration Phase PhaseIdentifier
| eval RunTime = round((End - Start) / 60, 0)
| eval Start=strftime(Start, "%c")
| eval End=strftime(End, "%c")
| rename RunTime AS "RunTime (Minutes)"
... View more