About funnysage

funnysage · ‎01-10-2019

This works perfectly. Thanks.

funnysage · ‎01-10-2019

Hi There, Thanks for the feedback. I used this criteria: (sourcetype=SourceType_A "Some str 1") OR (sourcetype=SourceType_B "Some str 2")|transaction maxspan=5s . Using this i was able to group together the series of events that i was interested in. However, i am getting some extra events. My output looks something like this: "Some str 1" "Some str 1" "Some str 1" <- event group that i am interested. I wanted this group as the output. "Some str 2" "Some str 1"

funnysage · ‎01-09-2019

Hi, This is a newbie question. I have two different searches. I want to combine the search results and only display a result where a certain event appears before another result. For e.g. Search1 : sourcetype=SourceType_A "Some str 1" Search2 : sourcetype=SourceType_B "Some str 2" Result set should be: Some str 2 Some str 1 So I want to show only those instances where "Some str 1" is followed by "Some str 2" and time gap in within say 3 secs.

Posts	3
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-09-2019

Online Status	Offline
Date Last Visited	‎04-27-2021 03:12 AM

How do you find consecutive events in two differen...

Re: How do you find consecutive events in two diff...

Re: How do you find consecutive events in two diff...

How do you find consecutive events in two differen...