In a earlier question I asked a question about an eval, this was luckily solved by Mus. Now I wonder how i can present the results in one line per ID
This is my search:
<my search>
| eval Start=if('message.information'=="Start",_time,null())
| eval End =if('message.information'=="End",_time,null()) |eval dur= Start-End
What I am searching for is how to get one line per ID , this is unique for all the events I want the duration for.
@Mike6960 ,
Try
your search |stats latest(eval(if('message.information'=="Start",_time,null()))) as Start, latest(eval(if('message.information'=="End",_time,null()))) as End by ID |eval dur=Start-End
You may use first
as well instead of latest