Adding column based on values from other columns

[Soogbad]

I have this code that shows me the start and end times of runs of a program:

index=index1 source=source1 | transaction startswith="Execution started" endswith="Execution ended" | eval start_time=_time | eval end_time=_time + duration | table start_time end_time

I also have this search which searches for errors (in a different log file):

search index=index1 source=source2 severity=ERROR

What I need is to add another column in the table that shows the runs of the program that would show how many errors occurred during the run of the program.

For example, appendcols like this:

<times_search> | appendcols [ search <error_search> | stats count as errors by _time ]

But this has two problems:

1) it's by _time when I need it to be by run. I need the amount of all the errors that occurred between start_time and end_time..

2) it's not sorted like I need it to be. As it says in the documentation, it puts the first result at the first row and the second in the second and so on

How do I achieve this? 

[ITWhisperer]

Do both sources have timestamps?

What about errors which occur after one end but before the next start?

[Soogbad]

Yes both sources have timestamps. Something like _time > start_time and _time < end_time would work. And  no there are no errors in between runs the errors are the program's errors they can't occur when it's not running.

[ITWhisperer · Accepted solution]

index=index1 source=source1 OR (source=source2 severity=ERROR)
| sort - _time
| streamstats last(eval(if(match(_raw,"Execution ended"),_time,null)) as end
| stats count(eval(if(severity="ERROR",1,null))) as errors by end