How to assign the 2 start_time and stop_time of one event into _time field ?

[Jouman]

Hi all,

I have an table with the start time and stop time in each case as below.

ID	Case Name	Start Time	Stop Time
user_1	Case_A	2023.08.10 13:26:37.867787	2023.08.10 13:29:42.159543
user_2	Case_B	2023.08.10 13:29:42.159545	2023.08.10 13:29:48.202143

Because I want to merge the duration of case execution with another event, I hope to transfer the above table into this kind of table.

_time	ID	Case Name	case_action
2023.08.10 13:26:37.867787	user_1	Case_A	start
2023.08.10 13:29:42.159543	user_1	Case_A	stop
2023.08.10 13:29:42.159545	user_2	Case_B	start
2023.08.10 13:29:48.202143	user_2	Case_B	stop

I could transfer the start time into _time by 

|eval _time='Start Time'

However, I can't think of a solution to record "Stop Time" into _time as well.

Does any one have a idea about how to accomplish this?

Thanks a lot.

[ITWhisperer · Accepted solution]

| eval time=mvappend('Start Time', 'Stop Time')
| mvexpand time
| eval _time=time