I updated the query with the criteria and using transaction to get the duration of the event. But for some reason duration is showing 0. How can I create a query to get the Results counting "Decline" > 5 , get start and end time of the events.
"Decline Time 1" "10:06 to 10:11"
"Decline Time 2" "10:15 to 10:20"
| streamstats current=f window=1 values(Price) as prev_price
| eval Result=case(Price<10,"Decline",Price>10,"Increase",1=1,"No Change")
| transaction startswith=Result=Decline endswith=Result=Decline
| table Time Result Price duration
Thanks
... View more