How to generate Previous Event Time into Current Event by matching a particular field value.

[vn_g]

Current Output :

Disconnected_time	Disconnected_Session_Name	count
2021-02-02T02:04:29.000	RDP-Tcp#10	12
2021-02-02T02:15:55.000	RDP-Tcp#27	6
2021-02-02T03:25:10.000	RDP-Tcp#10	11
2021-02-02T09:30:59.000	RDP-Tcp#27	5

PreviousEventTime should be generated based on "Disconnected_Session_Name" match

Example :

Disconnected_time	Disconnected_Session_Name	count	PreviousEventTime
2021-02-02T02:04:29.000	RDP-Tcp#10	12
2021-02-02T02:15:55.000	RDP-Tcp#27	6
2021-02-02T03:25:10.000	RDP-Tcp#10	11	2021-02-02T02:04:29.000
2021-02-02T09:30:59.000	RDP-Tcp#27	5	2021-02-02T02:15:55.000

[tread_splunk]

How are you getting on?

[tread_splunk · Accepted solution]

One more go...

| reverse
| streamstats current=f window=1 global=false last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

Have a look at the docs for streamstats and investigate the correct combination of window, global and first/last for your data set.

[vn_g]

This helped. Thanks a lot.

[tread_splunk]

| reverse
| streamstats current=f window=0 last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

...switch first(Disconnected_time) with last(Disconnected_time).

[tread_splunk]

Replace window=1 with window=0.

[vn_g]

No , the output is generating the same value for "PreviousEventTime" field.

Disconnected_time	Disconnected_Session_Name	PreviousEventTime
2021-02-02T23:31:37.000	RDP-Tcp#10
2021-02-02T23:25:15.000	RDP-Tcp#27
2021-02-02T17:58:18.000	RDP-Tcp#27	2021-02-02T23:25:15.000
2021-02-02T17:36:39.000	RDP-Tcp#27	2021-02-02T23:25:15.000
2021-02-02T16:32:07.000	RDP-Tcp#10	2021-02-02T23:31:37.000
2021-02-02T16:28:41.000	RDP-Tcp#10	2021-02-02T23:31:37.000
2021-02-02T14:59:04.000	RDP-Tcp#27	2021-02-02T23:25:15.000
2021-02-02T12:19:51.000	RDP-Tcp#10	2021-02-02T23:31:37.000

[tread_splunk]

Looking at it again, I think you need to reverse your results first...

| reverse
| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

[vn_g]

No, still it the same.

Current Output using streamstats :

Disconnected_time	Disconnected_Session_Name	PreviousEventTime
2021-02-02T23:31:37.000	RDP-Tcp#10
2021-02-02T23:25:15.000	RDP-Tcp#27
2021-02-02T17:58:18.000	RDP-Tcp#27	2021-02-02T23:25:15.000
2021-02-02T17:36:39.000	RDP-Tcp#27	2021-02-02T17:58:18.000
2021-02-02T16:32:07.000	RDP-Tcp#10
2021-02-02T16:28:41.000	RDP-Tcp#10	2021-02-02T16:32:07.000
2021-02-02T14:59:04.000	RDP-Tcp#27
2021-02-02T12:19:51.000	RDP-Tcp#10

Expected Output :

Disconnected_time	Disconnected_Session_Name	PreviousEventTime
2021-02-02T23:31:37.000	RDP-Tcp#10
2021-02-02T23:25:15.000	RDP-Tcp#27
2021-02-02T17:58:18.000	RDP-Tcp#27	2021-02-02T23:25:15.000
2021-02-02T17:36:39.000	RDP-Tcp#27	2021-02-02T17:58:18.000
2021-02-02T16:32:07.000	RDP-Tcp#10	2021-02-02T23:31:37.000
2021-02-02T16:28:41.000	RDP-Tcp#10	2021-02-02T16:32:07.000
2021-02-02T14:59:04.000	RDP-Tcp#27	2021-02-02T17:36:39.000
2021-02-02T12:19:51.000	RDP-Tcp#10	2021-02-02T16:28:41.000

[tread_splunk]

| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

[vn_g]

No, this is not generating the expected output. There are more than 200 session names which doesnot generate in any particular order.