I'm trying to adjust the following search:
index=pcindex sourcetype=parlayx | transaction corr | search "lvl=ERROR" | table SMS_MSISDN,corr,time
I use the transaction command in order to obtain one single meta-trace with common fields I'm interested in. Then, I filter only for the erroneous ones, and finally, showing results in a "table" format (with phone number, correlatorID, time).
The problem is that the meta-field that the transaction command creates contains more than one "time" (one for every trace).
57300xxxxxxx 09c3d697-d1d1-479c-bfef-839f874460f0 2015-06-30T03:47:10.618
2015-06-30T03:47:10.620
2015-06-30T03:47:10.621
2015-06-30T03:47:40.621
How can I get only one time result, or an average of them at least?
... View more