How to compare two query result fields of the same query parameter

[maruthi_s]

Hi

Example

Line 1 : Fox is Jumping out of burrow in 10 seconds
Line 2 : Fox is Jumping out of hole in 20 seconds

Query is "Fox" , I need to compare which time is faster , whether its burrow or hole.

How do i compare burrow and hole for fox /any animal .

Thanks
Maruthi

[woodcock · Accepted solution]

Like this:

... | rex "(?<subject>\w+).*\s+of\s+(?<source>\w+)\s+in\s+(?<delay>\d+)" | stats min(delay) AS delay by subject source | sort 0 delay | stats first(delay) AS delay first(source) AS source by subject

[maruthi_s]

Thanks @woodcock. This solution helps