As i see partial logout sessions too. I need to have searchmatch either Successful logout or Partial logout should match timestamp and it should reflect in the report.
If I use asterisk "1030105*:5" it display another event country timestamp event.
index=xyz hostname=device_* session_id=*
| rename COMMENT as "limit to needed fields"
| fields hostname, session_id, username, country, clientip
| rename COMMENT as "set the start and end times"
| eval session_start=if(searchmatch("103010005:5"),_time,null())
| eval session_end=if(searchmatch("103010521:5"),_time,null())
| rename COMMENT as "roll the records together"
| stats values(*) as * by hostname session_id
| rename COMMENT as "format the time fields"
| convert ctime(session_start) ctime(session_end)
| rename COMMENT as "present the results"
| table hostname, session_id, username, country, clientip, session_start, session_end
I need session end time either of the event Successful -logout or Paritial logout event. it should calculate whichever event is reflected first/last. 103010521:5 -- Successful logout / 103010502:5 -- Partial logout