Display result when comparing 3 fields, only show greater by 100 for one field

[baustin612]

I have a search that is giving me this data set:

ID             status       Stamp
alex         esb            1595989827764
alex         fuz             1595989827762
jake         esb            1596056447122
jake         fuz             1596056447085
josh         esb            1596054751935
josh         fuz             1596054751852
stefan    esb             1596056406846
stefan    fuz              1596056406806

I want to compare the Stamp by ID, and show any ID's where the stamp for esb is great than the stampe for fuz by at least 100. Any help appreciated.

[to4kawa]

|stats range(Stamp) as duration by ID

|where duration > 100

[baustin612]

Thank you for the quick reply!

How does this take into account status? I only want to display those where 'esb' timestamp is >= 'fuz' timestamp +100.

[isoutamo · Accepted solution]

Hi

Your Stamps haven't any greater than 100 so I use greater than 50.

index=_internal | head 1
| eval _raw="ID,             status,       Stamp
alex,esb,1595989827764
alex,fuz,1595989827762
jake,esb,1596056447122
jake,fuz,1596056447085
josh,fuz,1596054751852
josh,esb,1596054751935
stefan,esb,1596056406846
stefan,fuz,1596056406806" 
| multikv forceheader=1
| eval stamp=tonumber(trim(stamp))
| rename COMMENT as "previous prepare sample data"
| eval esb_stamp = if(status == "esb", Stamp, null())
| eventstats range(Stamp) as duration values(esb_stamp) as esb_stamp by ID
| table duration ID status Stamp esb_stamp
| where esb_stamp >= 50 + Stamp

r. Ismo 

[baustin612]

Thank you very much!