Finding paired events that are out of sequence (missequenced) or missing partner events

[woodcock]

We have a system that generates user-level start and stop event logs. Assume all events have a userID and sessionID and that start events have type=Start and stop events have type=Stop, how do I find/count transactions where there are multiple start events for a user without a stop event in-between them. Normally the start and stop events would be minutes apart but in this error scenario what we are seeing is the system generating multiple start events very close together in time. Sometimes the latter (duplicate but not identical) start events prevent the previous start events from ever getting the matching stop event (StartA, StartB, StopB) but other times we will see full pairing (StartA, StartB, StopB, StopA OR StartA, StartB, StopA, StopB). The normal sequence is StartA, StopA, StartB, StopB.

[woodcock · Accepted solution]

This will do it:

... | streamstats usecurrent=f last(type) AS prevType BY userid, sessionid | where type="Start" AND prevType="Start"

[woodcock]

There are many users so the same users show up in many events but each Start/Stop pair of events will share a unique-to-the-pair (across all events and users) sessionID. A users may only have 1 session at a time. The ideal search would show every time there are 2 starts (for a particular user) without a stop between them; that should be enough.

[kristian_kolb]

what would your sessionID's be like (in each event) for the StartA-StartB-StopA-StopB scenario?

Just what do you want your search/report to show?

/k