How can I combine two queries based on chronological order?

[dukie]

I have two searches and I am trying to join start and stop post based on event name. Problem is event name could be the same so ”stats first(*) as * by Event_same_name” is not working for me.

I have sorted the table based on time, so I know the start and stop is in chronicle and correct order

Table:

Event_same_name     Start_epoch     Stop_epoch
Event               time_A
Event                               time_B
Event               time_C  
Event                               time_D
Event               time_E  
Event                               time_F

Output:

Event_same_name     Start_epoch     Stop_epoch
Event               time_A          time_B                                 
Event               time_C          time_D                
Event               time_E          time_F

[renjith_nair · Accepted solution]

@dukie,

Try

"your search to sort events" |eval rowno=1|accum rowno
|streamstats current=f window=1 last(_time) as Start_epoch|where rowno%2==0|rename _time as Stop_epoch|fields - rowno

Start event which does not have an end event is neglected here.