Combining multiple events

[PowerBlade]

Hi

I have a question to how I do a report based on multiple events.
In this particular case, I started logging from our Cisco Wireless Lan Controller. I receive multiple AP association and disassociation events.
I can easily query to find the disassociation events and I can also easily query for association events.
But I'm having a problem how to form a query to combine the events. I want 2 different reports.
1) Get a list of access points that sent a disassociation event but no association events after that. (disappeared from the network)
2) Get a list of access points that sent an association event with no disassociation event before that (say within the last 24 hours) - (New access points added to the network)

Example to query for an disassociation event:

index=wireless bsnAPDisassociated | rex "bsnAPName.0 = STRING: \"(?<apname>\S+)\""

Example to query for an association event:

index=wireless ciscoLwappApMIBNotifs.4 | rex "cLApName.'\S+' = STRING: (?<apname>\S+)"

I will appreciate any hints I can get to solve my problem.

[lguinn2]

Here is a start - what time range do you intend to search?

index=wireless bsnAPDisassociated OR ciscoLwappApMIBNotifs.4
| eval eventCategory=if(match(_raw,"ciscoLwappApMIBNotifs.4"),"Disassociated","Associated")
| rex "bsnAPName.0 = STRING: \"(?<apname1>\S+)\""
| rex "cLApName.'\S+' = STRING: (?<apname2>\S+)"
| eval apname = if(eventCategory=="Associated",apname2,apname1)
| eval timeAssoc =if(eventCategory=="Associated", _time,null())
| eval timeDisassoc =if(eventCategory=="Disassociated", _time,null())
| stats earliest(timeAssoc) as earliestTimeAssoc latest(timeAssoc) as latestTimeAssoc count(eval(eventCategory="Associated")) as AssocCount
earliest(timeDisassoc) as earliestTimeDisassoc latest(timeDisassoc) as latestTimeDisassoc count(eval(eventCategory="Disassociated")) as DisassocCount
 by apname

[martin_mueller]

I see two approaches, transaction and streamstats.

Taking query 1 as an example, you could filter for (association OR disassociation) events and walk the events by AP id with streamstats. On the way you have it number the events. Then you filter to get only the events with the lowest number - those that are disassociation events are APs that disassociated, but have not associated since.