- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
is it possible to a add field to each event and add a value to this field, that shows the chronological count of the specific event per user? Let's call this field "eventserial".
So that the first event per user (the event per user with the earliest timestamp) has an eventserial of "1". The second event of the users lifecycle has an eventserial of "2", and so on.
Thanks in advance
Heinz
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So you can try this:
your_search | streamstats count as "eventserial" by user | timechart span=5m max(eventserial) by user
This will assign the first event seen with a value of 1, and then increment by user as it pulls in more events. Then the timechart is just showing that the values increase by user as time decreases.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

So you can try this:
your_search | streamstats count as "eventserial" by user | timechart span=5m max(eventserial) by user
This will assign the first event seen with a value of 1, and then increment by user as it pulls in more events. Then the timechart is just showing that the values increase by user as time decreases.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
great, seems to work 🙂
thanks a lot
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You can try: your_search | reverse | streamstats count as "eventserial" by user
Streamstats will do the count based on how the events are streaming in from the indexers.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for your post. this seems to add the value of 1 to the most recent event. can we change the search to add the value 1 to the "oldest" event?
