Extract a field which apears only in the first event of a transaction

[eisaak]

I have the following to display average latency.
It can be accelerated (vs. using the transaction command).
Now I would like to update this to "average latency per request type". Bu the requestType can be extracted only from the first event of each of the "transactions" below.

...stats min(_time) AS startOfTransaction max(_time) AS endOfTransaction by context_flow | eval transactionDuration=endOfTransaction-startOfTransaction | bucket startOfTransaction span=1h | eval startOfTransaction = strftime( startOfTransaction,"%m/%d/%Y %I:%M:%S") | stats avg(transactionDuration) as avgDuration by startOfTransaction | chart sum(avgDuration) as "Average Latency in Seconds" by startOfTransaction

[martin_mueller · Accepted solution]

Include first(requestType) as requestType in your stats calls to carry that field through the entire pipeline.