Count the number of events in between a recurring event

[myli12]

I have an event "trans" occurs from time to time, I want to be able to count the number of another type of events (say "down") occur in between this recurring event "trans".

What I tried is

link OR down | transaction endswith="trans" | stats count

Which actually gives me counts of transactions, rather than number of "down" events in between "trans" events.

[David · Accepted solution]

The transaction command adds the eventcount field. I'd try:

link OR down | transaction endswith="trans" | stats avg(eventcount)

Or if you like:

link OR down | transaction endswith="trans" | table _time duration eventcount