I have two searches:
Search A
index=my_idx sourcetype=my_st Name=conference Message= joined
| stats count by _time Paticipant Conference Display Name Location Protocol
Search B
index=my_idx sourcetype=my_st Name=conference Message= disconnected
| stats count by _time Participant Conference Duration DisplayName Location Protocol
I would like create a table that combines the Duration field with all the fields from Search A. I would then like to include a column for the join time and the disconnect time that correlates to the value of Duration.
The output would look like this:
Seach C Out Come
Participant Conference Join_Time Disconnect_Time Duration DisplayName Location Protocol
Thank you,
Jason H.
index=my_idx sourcetype=my_st Name=conference (Message=joined OR Message=disconnected)
| eval joined_time=if(Message="joined",_time,null())
| eval disconnected_time=if(Message="disconnected",_time,null())
| stats values(Duration) as Duration values(joined_time) as joined_time values(disconnected_time) as disconnected_time by Participant Conference DisplayName Location Protocol
index=my_idx sourcetype=my_st Name=conference (Message=joined OR Message=disconnected)
| eval joined_time=if(Message="joined",_time,null())
| eval disconnected_time=if(Message="disconnected",_time,null())
| stats values(Duration) as Duration values(joined_time) as joined_time values(disconnected_time) as disconnected_time by Participant Conference DisplayName Location Protocol
@ITWhisperer This is great, thank you!
The Duration field display the duration as a value such as 3402.578 I believe this is to be in seconds and miliseconds. How would I change this to hh:mm:ss?
@ITWhisperer
I did try this: | eval Duration = strptime(Duration, "%H:%M:%S")
But the out come is like 19:00:10, which doesn't seem possible me.
But your solution did the trick. I didn't know you could use tostring like that.