End transaction somewhere in the middle.

[vanaepi]

I have 20 records in a transaction. Each of those records has a status.

Possible status are created, opened, closed, accepted, rejected and they can occur multiple times in one transaction. An example would be

created
opened
closed
opened
closed
accepted

Now, I want to find out two durations. From created till the last occurence of closed, and from created to accepted. The last one is easy, I just don't provide startswith/endswith parameters.

But getting the duration until the last occurence of closed is tricky. Because endswith would take the first occurence of closed to end the transaction. And I can't count either, because well I don't know how many records there are after the last closed. Now it's one, but it might as well could be three.

How would I go about doing this?

[kristian_kolb · Accepted solution]

I think you have to be a bit clearer regarding your patterns.

Exactly 20 records/transaction?
Always start with 'created'?
Always end with 'accepted'?
'opened' and 'closed' always come in pairs?
'closed' is not necessarily the second last value?

At first I was thinking of the mv*-functions for eval, but perhaps there is a simpler way. Assuming that you have a transaction_ID (or whatever you use to create your transactions in the first place) in each event - you may be able to get by with plain old stats;

sourcetype=your_sourcetype created closed 
| stats max(_time) as mxt min(_time) as mit by transaction_ID 
| eval short_dur = mxt - mit

/K

[vanaepi]

Not always 20 records, always starts with created and only occurence of created, opened and closed always come in pairs, does not always end on accepted, can end on rejected and accepted and rejected could come in pairs too. So close isn't always the second last value.

But your stats thingy did the trick. Thanks!