Group event

[Nadeige]

Hello,

I have some log events that are structured like that:

<timestamp> - [INFO] <serialnumber 1>
<timestamp> - [INFO] <errocode>
<timestamp> - [INFO] <errocode>
<timestamp> - [INFO] <serialnumber 2>
<timestamp> - [INFO] <errocode>

How can I group the error_code events with the corresponding serialnumber event, meaning the previous event?

Thank you

[to4kawa]

| makeresults
| eval _raw="- [INFO] 123456
- [INFO] 402
- [INFO] 404
- [INFO] 789012
- [INFO] 412"
| multikv noheader=t
| table _time _raw
| streamstats count
| eval _time = _time + count * 2
| rex "(?<serialnumber>\d{6})"
| rex "\b(?<error_code>\d{3}"\b)
| streamstats count(eval(serialnumber)) as session
| eventstats list(error_code) by session

like above?
sort _time (or reverse) and try streamstats

[isoutamo]

Are you looking for search or indexing time solutions?