Compare _time of 2 events

[g_paternicola]

Hi everyone,

I have two event:

first event with the event_name=LOGIN
second event with event_name LOGOUT

I need to get only events with event_name=LOGIN, but only if the event_name=LOGIN time is newer then the event_name LOGOUT

Is there a possibility to do so? Thank you very much for helping me!

[g_paternicola]

Hi Alessandro

Thank you for your search,  unfortunately, I do not get any data back... 
This is the time I will get:

I this case, logout is newer then login, so I should not get any data back...

[aasabatini]

Hi @g_paternicola 

I'm not sure if I understand but try this:

| eval time_login=if(event_name=LOGIN,_time,"")
| eval time_logout=if(event_name=LOGOUT,_time,"")
| where time_login > time_logout

If I missed the point please give more details

Alessandro

[aasabatini]

Hi @g_paternicola 

please show me the result of this search

| eval time_login=if(event_name=LOGIN,_time,"")
| eval time_logout=if(event_name=LOGOUT,_time,"")
| tale event_name time_login time_logout

 event_name=LOGIN newer than event_logout do you mean more recent?

thanks in advance

Alessandro

[g_paternicola]

Yes, with newer I mean more recent:
I will get this result:

[aasabatini · Accepted solution]

@g_paternicola 

sorry man I forgot the double quotes 😅

| eval time_login=if(event_name="LOGIN",_time,"")
| eval time_logout=if(event_name="LOGOUT",_time,"")
| where time_login > time_logout

[g_paternicola]

It works now... Grazie!

[aasabatini]

@g_paternicola  Prego!

if works please accept the solution