I have a table like this:
I would like to propagate "start" value and "end" value if "_time>=start AND _time<end".
It's like a "transaction" with "startwith and endwith", but I need to use "streamstats", because I can't lost event details.
So I would like to obtain:
Given the limited example of what you are trying to do, can you do something with eventstats
| eventstats values(start) as start values(end) as end
| eval start=if(_time>=start AND _time <= end, start, null())
| eval end=if(_time>=start AND _time <= end, end, null())