Combining Fields from Two Different Seaches

[jason_hotchkiss]

I have two searches:

Search A
index=my_idx sourcetype=my_st Name=conference Message= joined
| stats count by _time Paticipant Conference Display Name Location Protocol

Search B
index=my_idx sourcetype=my_st Name=conference Message= disconnected
| stats count by _time Participant Conference Duration  DisplayName Location Protocol

I would like create a table that combines the Duration field with all the fields from Search A.  I would then like to include a column for the join time and the disconnect time that correlates to the value of Duration.

The output would look like this:

Seach C Out Come

Participant Conference Join_Time Disconnect_Time Duration DisplayName Location Protocol

Thank you,
Jason H.

[ITWhisperer · Accepted solution]

index=my_idx sourcetype=my_st Name=conference (Message=joined OR Message=disconnected)
| eval joined_time=if(Message="joined",_time,null())
| eval disconnected_time=if(Message="disconnected",_time,null())
| stats values(Duration) as Duration values(joined_time) as joined_time values(disconnected_time) as disconnected_time by Participant Conference  DisplayName Location Protocol

[jason_hotchkiss]

@ITWhisperer This is great, thank you!

The Duration field display the duration as a value such as 3402.578  I believe this is to be in seconds and miliseconds.  How would I change this to hh:mm:ss?

[ITWhisperer]

Try this:

| eval Duration=tostring(Duration,"duration")

[jason_hotchkiss]

@ITWhisperer 

I did try this: | eval Duration = strptime(Duration, "%H:%M:%S")
But the out come is like 19:00:10, which doesn't seem possible me.

But your solution did the trick.  I didn't know you could use tostring like that.