I need to define an outer time range, simple:
earliest=-3h
I then want to filter the results, also simple:
earliest=-3h | stats count(_raw) as count by stuff | where count%2=1
But now the part I am struggling with. I want to define a time range that is even more restrictive:
earliest=-3h | stats count(_raw) as count by stuff | where count%2=1 | earliest=-2h
This syntax is invalid but hopefully describes what I am trying to achieve. I must have the outer time range, filter and then apply a further time range, is this possible?
Based on the bottom search, you're trying to find events that happen in the past two hours where the count of events by stuff
is odd in the past three hours?
If so, consider this:
earliest=-3h | eventstats count by stuff | where count%2=1 AND _time >= relative_time(now(), "-2h")
As for your search failing, there's two things going on. First, you need a search command such as where
or search
after the last pipe. Second, at that point in the search pipeline the _time
field is already discarded by stats
so even with correct syntax you wouldn't be able to filter on time any more. eventstats
takes care of that by adding a count
field to the events without discarding anything.
For future reference, the problem I was trying to solve is the pairing up of events that are separated by a matter of minutes. I can't use a fixed time range for this as it could split a valid pair. Therefore, I wanted to define a broad time range and then filter out non-pairs within this range.
Based on the bottom search, you're trying to find events that happen in the past two hours where the count of events by stuff
is odd in the past three hours?
If so, consider this:
earliest=-3h | eventstats count by stuff | where count%2=1 AND _time >= relative_time(now(), "-2h")
As for your search failing, there's two things going on. First, you need a search command such as where
or search
after the last pipe. Second, at that point in the search pipeline the _time
field is already discarded by stats
so even with correct syntax you wouldn't be able to filter on time any more. eventstats
takes care of that by adding a count
field to the events without discarding anything.
Thanks Martin you made a number of useful points:
The main problem I faced with my efforts was the use of stats which, as you say, meant that _time was no longer available. I am now up and running.