Generate a report where it will output table with different timings in columns

[jcsvaldueza]

I need to generate a report where it will output table with different timings in columns.

Trick part is logs captured fall under a unique transaction ID

index=<app> "Start Time" OR "End Time"

Sample Output Log (Note that this is under 1 transaction ID):

8:00 TransID "Start Time"

8:01 TransID "End Time"

8:30 TransID "Start Time"

8:31 TransID "End Time"

9:00 TransID "Start Time"

9:01 TransID "End Time"

Table should look like:

TransID StartTime1 EndTime1 Duration1 StartTime2 EndTime2 Duration 2 StartTime3 EndTime3 Duration3

0123 8:00 8:01 1:00 8:30 8:31 1:00 9:00 9:01 1:00

[yuanliu]

There are two separate challenges one about transform the presentation, the other getting the header into the desired order.  Here is my crack at it.  To begin, you need to extract TransID and the marker "Start time" or "End time".  How you do it is up to you because the data illustrated doesn't seem to be the raw format, at least not the timestamp.  I will take the illustrated format literally.

| rex "(?<time>\S+) (?<TransID>\S+) \"(?<marker>[^\"]+)"
| streamstats count by marker
| eval marker = marker . count
| xyseries TransID marker time
| transpose 0 header_field=TransID
| eval order = if(column LIKE "Start%", 1, 2)
| eval sequence = replace(column, ".+Time", "")
| sort sequence order
| fields - sequence order
| transpose 0 header_field=column column_name=TransID

So, the bigger challenge is to get desired order of headers.  I have to expense two tranposes.  If you do not need that strict order, things are much simpler.  Output from your mock data is

TransID	Start Time1	End Time1	Start Time2	End Time2	Start Time3	End Time3
0123	8:00	8:01	8:30	8:31	9:00	9:01

Here is an emulation for you to play with and compare with real data

| makeresults format=csv data="_raw
8:00 0123 \"Start Time\"
8:01 0123 \"End Time\"
8:30 0123 \"Start Time\"
8:31 0123 \"End Time\"
9:00 0123 \"Start Time\"
9:01 0123 \"End Time\""
``` the above emulates
index=<app> "Start Time" OR "End Time"
```