Hi Mus,
thank you for fast response
the Problem within this is that i get the earliest and the latest value="1".
What i need is that the Value="1" (endswith) appears in the next transaction as Value="1"(startswith).
I need the duration time between every Value="1" 's.
Another solution which would help would be to include a different Value="2" in the Middle, which exists in the data and is always between the 1's.
What i tried to do so is following.
index="test" | transaction param mvlist=t startswith=eval(Value="1") endswith=eval(Value="2") | table param Create_time Value | append [search index="test" | transaction param mvlist=t startswith=eval(Value="2") endswith=eval(Value="1") | eval mvindex(Value,-1) = 77 ] | table param Create_time Value
then my next step would have been to combine or make a transaction from Value="1" to Value="77" but the assignment eval mvindex()=77 doesnt work.
Maybe you have another suggestion?
... View more