How to create pairs of events based on non-unique id

[jerrynandak]

I have hundreds of thousands of events of this form.

id event_type
11 ack
11 req
11 ack
12 req
11 req
12 ack
11 ack
13 req
12 req
12 req
11 req
12 ack
13 ack
12 ack
13 req

How can I create req-ack pairs of these events so that I can find the time difference between req and ack?

Expected pairing:
11 req-ack, req-ack
12 req-ack, req-ack, req-ack
13 req-ack
   

[jerrynandak]

Hi @gcusello 

values() only stores distinct values. So, your solution gives the following output which doesn't match my expected result.

11	ack req
12	ack req
13	ack req

[gcusello]

Hi @jerrynandak,

add nomv to the end:

| makeresults | eval id=11,  event_type="ack" | fields id event_type
| append [ | makeresults | eval id=11,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=11,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=11,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=11,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=13,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=11,  event_type="req" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=13,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="ack" | fields id event_type ]
| append [ | makeresults | eval id=12,  event_type="req" | fields id event_type ]
| stats values(event_type) AS event_type BY id
| nomv event_type

Ciao.

Giuseppe

[gcusello]

Hi @jerrynandak,

please try this:

<your_search>
| stats values(event_type) AS event_type BY id 

Ciao.

Giuseppe