index="prod" sourcetype="applogt" "AppClusterMember stopped" |convert ctime(_time) as StoTime timeformat=%H:%M |convert ctime(_time) as Date timeformat=%x|stats values(StoTime) as StopTime by Date,host|stats list(host) as Host, list(StopTime) as StopTimee by Date|sort -Date|appendcols[search index="prod" sourcetype="applogt" "AppClusterMember started" |convert ctime(_time) as StaTime timeformat=%H:%M |convert ctime(_time) as Date timeformat=%x|stats values(StaTime) as StartTime by Date,host|stats list(host) as Host,list(StartTime) as StartTimee by Date|sort -Date]
This is my search where i'm not getting the sorted output if application was stopped & started twice or more in a day. I'm getting the below output.
Date Host StopTime StartTime
1/4/2017 Node1 1:23 1:30
Node2 1:30 1:42
Node3 1:45 1:52
Node4 1:53 2:04
1:42 1:45
1:48 1:55
1:52 1:59
2:04 2:12
... View more