Suppose that there are two types of events: "down" and "link" and sometimes there are multiple reports/events correponding to one unique "link" event (suppose link events happend within 10s refers to one event)
The following groups all the "link" events in between "down" in one transaction.
"link" or "down" | transaction endswith="down"
However, I cannnot further use transaction to group link events happening within 10s apart. Is there any search phrase that allows you to calculate the number of unique "link" events in between "down" events?