What I want to do is to extract transactions; It seems that events A-B-C (ev_id) make one transaction group, almost every ten seconds. For example, transaction startswith=eval(ev_id="A") endswith=eval(ev_id="C") maxspan=2s could be applied.
When I indexed the above sample event data, at Set Source Type step, I chose Source Type=CSV, Timestamp Extraction=AUTO. What I got by spl source=... | table _time ts ev_id val ts_SEQ | sort _time is shown below.
Unfortunately, the ascending order of _time destroys the original event sequence (ts_SEQ), that means,
the above mentioned transaction extraction would be impossible. Currently, my work around is to add the ts_SEQ value to the original data before indexing, and use ts_SEQ to keep the original event sequence.
Question: How to extract timestamp without destroying the sequence of original events from my sample data?
That's what I want to find solutions.
In other words, at the indexing stage, if multiple events have same
timestamp value (let's assume YYYY-MM-DD HH:MM:SS format),
is there any way to keep the sequence of the original events
when table _time ... command is applied without assist data (ts_SEQ)?