log1 : user_id , status=interrupt, log2 : user_id, status = success Hi All, I want to find user_ids that failed due to an interrupt after initial success state for a period last 30days. I tried transaction command, the query runs slow and same with subsearch. In Stats, i am not able to figure out how to make sure that I search only "interrupt" that comes after the success and not the ones that occurred before it. In my base query i take only the logs with two states. Since I run for last 30days, i'm not able to make sure if the interrupt has occurred after the success or it occurred separately. Time duration between these two events mostly wont be more than 30s. What I've right now is : time_duration not more than 30s, User_id and interrupt should come after success. Need some advice on how to achieve this with Stats command. with transaction i've tried something like this. base_query status="success" OR status="interrupt" | transaction user_id startswith=(status="success") endswith=(status="interrupt") maxspan=30s | stats count by user_id I had checked other answers with respect to Transaction command, but i did not find those as satisfactory to what I'm looking for.
... View more
