All Apps and Add-ons

Display value from field if value from other field changes within x mins

jbesant
Explorer

Hello, I am after some help to define the search that will display a list of field values if the value in another field changes from one value to another within a certain time frame

For example, I want to see the value of the field ID if the value of the field Loc changes from ABC to DEF within 30 minutes.

Thanks in advance.

Tags (1)
1 Solution

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

View solution in original post

somesoni2
Revered Legend

My guess will be that You could try transaction command on the ID field. May be something like this

your base search | transaction ID maxspan=30m startswith=ID=ABC endswith=ID=DEF | table your fields 

View solution in original post

jbesant
Explorer

Thanks. I made a small modification and that gave me exactly what I wanted. It showed all the locations (Loc) within the 30 minutes time window of the ID. Appreciated.

my search | transaction ID maxspan=30m startswith=Loc=ABC endswith=Loc=DEF | table ID Loc
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.