I've got two different events that have identical data points, including an id. I'd like to join the events on an id and then find the delta between a field that's found in each one.
For example
Event1: { type='eventA', id: '123', duration: 500}
Event2: { type='eventB' ,id: '123', duration: 550}
Event3: { type='eventB' ,id: '456', duration: 200} // this one should be ignored since it doesn't have an id that found in both eventA and eventB
I'd like to get some output like this:
p95(eventA_duration) p95(eventB_duration) p95(delta_duration)
(i.e. I think there'd be something in there like: | eval delta_duration = eventB_duration - eventA_duration )
Many thanks!
... View more