hello
im trying to calculate min and max time of event (the time when the event started and when its ended)
when im adding my calculation to the query im loosing the results of the rest of the query and getting only the result of the time calculation...
what am i missing ?
index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"
| transaction maxpause=2s maxspan=1s maxevents=5
| stats first(_time) as min_time, last(_time) as max_time
| table _time,eventcount, eventtype, tail_id, kafka_uuid,min_time,max_time
| foreach eventtype
[eval flag_eventtype=if(eventcount!=5,"no", "yes")]
transaction
has only one _time
so i can i do it differently ?
Why don't you try using a command other than transaction
?
or extract _time
by using rex
again.
im open to try, i just don't know what and how 🙂
it looks like using transaction is the right way.. so how can i use rex to extract _time ?
I don't know, check your log.