I am having two types of events that I am interested in - one that says something about usage flows of a mobile app, the other if the app has crashed. I would like to find what type of usage patterns that leads into a crash x minutes before the crash happens - for all crashes.
In order to do so I have this query to see usage 5 mins prior to crash log is uploaded:
my_indexes type=some_mobile_brand [search my_indexes type=some_mobile_brand SM_C.key=CrashUploaded | fields userId] | transaction userId endswith=CrashUploaded maxspan=5m | stats values(userpattern)
Now, I have a problem that after a crash it takes some time before the CrashUploaded metric is sent and I would like to filter out userpatterns AFTER the crash but BEFORE the CrashUploaded metric got sent.
In all events there are a sessionId that is distinct for each active session (only changes when the app restarts). So I need to be able to filter out all userpatterns that has the same sessionId as the CrashUploaded event. However, I am unable to find a good way of doing it without also filtering out the CrashUploaded metric.
Any way I could keep the CrashUploaded event, but filter out all events with the userpattern value with the same sessionIds as the CrashUploaded events?
... View more