How to achieve list of manid breaching Authorization SLA?

[Sekhar]

We have two events query

Start event

Index=x source type= xx "String" extacted fields s like manid,actionid,batch I'd

End event 

Index=y source type=y " string recived" extacted fields like manid ,actionid

Calculate different between start and end events group by manid and count number of mandid exceeding different above 30 sec .  | Table _time manid duration

index=x source type= xx "String") OR (index=y source type=y " string recived") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = max(time) - min(time)|eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg by manid

But unable get _time vaules 

[ITWhisperer]

You still have the same question as I asked you the last time you posted about this - which time do you want? The min time or max time?

(index=x source type= xx "String") OR (index=y source type=y " string recived") | stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid | eval duration = max(time) - min(time)|eval excessive = if(duration > 30, duration, null()) | stats count(excessive) as excess_count avg(excessive) as excess_avg max(time) as _time by manid

[yeahnah]

Hi @Sekhar 

Using values will result in a multivalue output (possibly more than 1 value) field, so you need to use multivalue eval commands to process that output.

Anyway, in this the best place to find the start (min) and end (max) times is by using the stats command and then eval the difference.  Something like this should meet your needs...

index=x source type= xx "String") OR (index=y source type=y " string recived") 
| stats
    min(_time) as start_time
    max(_time) as end_time
    values(actionid) as actionid
    values(batchid) as batchid
  by manid 
| eval duration = (end_time - start_time) 
| eval excessive = if(duration > 30, duration, null()) 
| stats count(excessive) as excess_count avg(excessive) as excess_avg by manid

Hope that helps

[Sekhar]

Above  query i add table but not displayed any thing 

| Table start_time duration  mandid