* | transaction ACCOUNT
* | stats values(_raw) by ACCOUNT
mysearch1 [ search mysearch2 | dedup ACCOUNT | table ACCOUNT ]
Probably you should specify a few sample events. Is it only interesting to report if the events are sequential? How do you find the 'first' event (that you want to find a sequel to)?
Some commands that may prove useful (read up on them in the Search Reference manual;
dedup (possibly in conjunction with
stats functions like
transaction on ACCOUNT
or a simple
For the above data, I want to see a output like this:
NEXTTYPE, NEXTCAUSE, NEXTRESOLUTION, and DURATION should be blank if there are no next events.