Consecutive events by field - only show points in time where number of such events equals 5

[isvaljek]

I'm trying to find points in time where a consecutive event happens 5 times in a row.
I currently have this query:

partner_id=9991| streamstats count BY timeout reset_on_change=true  | table timeout, count, _time

But it shows both timeout combinations and their increasing count.

[woodcock]

Can't you just add | where count==5?

[renjith_nair]

@isvaljek ,

If you just want one event where number equals 5 use |where count=5

partner_id=9991| streamstats count BY timeout reset_on_change=true  | table timeout, count, _time|where count=5

If you want all the events which are contributing to the consecutive events (ie, event 1 to event 5(n)), try below

partner_id=9991|streamstats last(timeout) as prev window=1 current=f|eval flag=if(timeout==prev OR isnull(prev),0,1)
|accum flag|eventstats count by flag|where count>=5