Finding Events Between Other Events

[DLThurston]

I might be confusing myself by making this harder than it is...

Say I have a log where the events are:

LOGIN
ACTION (1)
ACTION (2)
LOGOUT
LOGIN
ACTION (3)
ACTION (4)
ACTION (5)
LOGOUT

What I would like is to be able to display all the ACTION events that happened between just the first LOGIN/LOGOUT pair and output:

ACTION (1)
ACTION (2)

This is in a dashboard, and I've got dropdowns to identify each unique LOGIN event, those are working just fine. I tried a transaction, but I think that might be the wrong tool for the job, and I'm worried I got too fixated on that and am now missing the forest for the trees. What I want is all ACTION events bounded by the selected LOGIN and the next subsequent LOGOUT. So in terms of metacode I want something along the lines of...

| search ACTION earliest=LOGIN._time latest=LOGOUT._time

Does that make sense? Am I approaching this from the wrong direction? Or is this just a bit of search code I haven't figured out?

[ITWhisperer]

Is there any attribute in the events which ties the action events to the login session they are part of?

[DLThurston]

Unfortunately no. What I'm basically attempting to do is create sessions where none exist within a text-based log that shows login/logout events, but where the actions in between are not tied to a session or to a user account. Fun, right?

[ITWhisperer]

| makeresults | eval _raw="LOGIN
ACTION (1)
ACTION (2)
LOGOUT
LOGIN
ACTION (3)
ACTION (4)
ACTION (5)
LOGOUT"
| multikv noheader=t
| fields _raw
| fields - _time
| streamstats count(eval(_raw="LOGIN")) as session
| where _raw != "LOGIN" AND _raw != "LOGOUT"
| stats values(_raw) as events by session