How to combine a search that relies on latest(_time) for two different fields

[ebs]

Hi,

I want to create a search that is able to grab both the start and end times of a specific action, but to create the fields they both use latest(_time). Here are the two searches I want to combine:

Start:

index=index_name act="LDAP Synchronization start" | stats latest(_time) as start | eval "LDAP Sync Start"=strftime(start,"%d/%m/%Y %H:%M:%S")

End:

index=index_name act="LDAP Synchronization end" | stats latest(_time) as end | eval "LDAP Sync End"=strftime(end,"%d/%m/%Y %H:%M:%S")

How can I combine these two searches into one search, especially since I rely on the same stats command to create the field?

[bowesmana · Accepted solution]

Like this

index=index_name act="LDAP Synchronization start" OR act="LDAP Synchronization end"
| stats max(eval(if(act="LDAP Synchronization start", _time, 0))) as start max(eval(if(act="LDAP Synchronization end", _time, 0))) as end
| eval "LDAP Sync Start"=strftime(start,"%d/%m/%Y %H:%M:%S"), "LDAP Sync End"=strftime(end,"%d/%m/%Y %H:%M:%S")

i.e. use an eval in the stats so that the max _time (i.e. latest) of start and end time is evaluated during aggregation.