How do you group Start and End times from a set of log events?

[OnderSentira]

How can I group the start and end time of an station like attachment shows? The startime with X I want to skip, 

[OnderSentira]

Hi @gcusello 
when I use the following script then I get the result below:

.......
| mvexpand TimeStamp
| stats min(_time) AS NotAvailableTimeStamp max(_time) AS AvailableTimeStamp BY owcs_msg_station Row field1
| eval NotAvailableTimeStamp=strftime(NotAvailableTimeStamp,"%Y-%m-%d %H:%M:%S.%3N"), AvailableTimeStamp=strftime(AvailableTimeStamp,"%Y-%m-%d %H:%M:%S.%3N")

The result: There is "field1" column with correct information. 

[OnderSentira]

Hi @gcusello 

I have used your script but the both TS column have same value now:

[gcusello]

Hi @OnderSentira,

what's the problem?

im my test I have for each Station more transactions with start and end time.

please give me a sample of the result tha you have and the ones you want, e.g. for one Station.

Ciao.

Giuseppe

[OnderSentira]

Hi Giuseppe

The both column have same timestamp.

[OnderSentira]

Spoiler

Hi Giuseppe,

See part of the events below. And I have used the following Script to extract the fields from the events:

my Search "MyApp<<<--MQ: 025;"
| eval ret_event = split(_raw, ":")
| eval owcs_msg = mvindex(ret_event,4)
| eval owcs_msg_splited = split(owcs_msg, ";")
| eval owcs_msg_id = mvindex(owcs_msg_splited,0)
| eval owcs_msg_station = mvindex(owcs_msg_splited,1)
| eval owcs_msg_status = mvindex(owcs_msg_splited,2)
| eval start = if(owcs_msg_status = 57,_time,"")
| eval stop = if(owcs_msg_status = 59,_time,"")
| eval start= strftime(start,"%Y-%m-%d %H:%M:%S.%3N")
| eval stop= strftime(stop,"%Y-%m-%d %H:%M:%S.%3N")

[gcusello]

Hi @OnderSentira,

sorry, but what's the correlation rule?

in other words: why do you exclude some values and takes some other?

Ciao.

Giuseppe