Current Output :
Disconnected_time | Disconnected_Session_Name | count |
2021-02-02T02:04:29.000 | RDP-Tcp#10 | 12 |
2021-02-02T02:15:55.000 | RDP-Tcp#27 | 6 |
2021-02-02T03:25:10.000 | RDP-Tcp#10 | 11 |
2021-02-02T09:30:59.000 | RDP-Tcp#27 | 5 |
PreviousEventTime should be generated based on "Disconnected_Session_Name" match
Example :
Disconnected_time | Disconnected_Session_Name | count | PreviousEventTime |
2021-02-02T02:04:29.000 | RDP-Tcp#10 | 12 | |
2021-02-02T02:15:55.000 | RDP-Tcp#27 | 6 | |
2021-02-02T03:25:10.000 | RDP-Tcp#10 | 11 | 2021-02-02T02:04:29.000 |
2021-02-02T09:30:59.000 | RDP-Tcp#27 | 5 | 2021-02-02T02:15:55.000 |
One more go...
| reverse
| streamstats current=f window=1 global=false last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name
Have a look at the docs for streamstats and investigate the correct combination of window, global and first/last for your data set.
How are you getting on?
One more go...
| reverse
| streamstats current=f window=1 global=false last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name
Have a look at the docs for streamstats and investigate the correct combination of window, global and first/last for your data set.
This helped. Thanks a lot.
| reverse
| streamstats current=f window=0 last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name
...switch first(Disconnected_time) with last(Disconnected_time).
Replace window=1 with window=0.
No , the output is generating the same value for "PreviousEventTime" field.
Disconnected_time | Disconnected_Session_Name | PreviousEventTime |
2021-02-02T23:31:37.000 | RDP-Tcp#10 | |
2021-02-02T23:25:15.000 | RDP-Tcp#27 | |
2021-02-02T17:58:18.000 | RDP-Tcp#27 | 2021-02-02T23:25:15.000 |
2021-02-02T17:36:39.000 | RDP-Tcp#27 | 2021-02-02T23:25:15.000 |
2021-02-02T16:32:07.000 | RDP-Tcp#10 | 2021-02-02T23:31:37.000 |
2021-02-02T16:28:41.000 | RDP-Tcp#10 | 2021-02-02T23:31:37.000 |
2021-02-02T14:59:04.000 | RDP-Tcp#27 | 2021-02-02T23:25:15.000 |
2021-02-02T12:19:51.000 | RDP-Tcp#10 | 2021-02-02T23:31:37.000 |
Looking at it again, I think you need to reverse your results first...
| reverse
| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name
No, still it the same.
Current Output using streamstats :
Disconnected_time | Disconnected_Session_Name | PreviousEventTime |
2021-02-02T23:31:37.000 | RDP-Tcp#10 | |
2021-02-02T23:25:15.000 | RDP-Tcp#27 | |
2021-02-02T17:58:18.000 | RDP-Tcp#27 | 2021-02-02T23:25:15.000 |
2021-02-02T17:36:39.000 | RDP-Tcp#27 | 2021-02-02T17:58:18.000 |
2021-02-02T16:32:07.000 | RDP-Tcp#10 | |
2021-02-02T16:28:41.000 | RDP-Tcp#10 | 2021-02-02T16:32:07.000 |
2021-02-02T14:59:04.000 | RDP-Tcp#27 | |
2021-02-02T12:19:51.000 | RDP-Tcp#10 |
Expected Output :
Disconnected_time | Disconnected_Session_Name | PreviousEventTime |
2021-02-02T23:31:37.000 | RDP-Tcp#10 | |
2021-02-02T23:25:15.000 | RDP-Tcp#27 | |
2021-02-02T17:58:18.000 | RDP-Tcp#27 | 2021-02-02T23:25:15.000 |
2021-02-02T17:36:39.000 | RDP-Tcp#27 | 2021-02-02T17:58:18.000 |
2021-02-02T16:32:07.000 | RDP-Tcp#10 | 2021-02-02T23:31:37.000 |
2021-02-02T16:28:41.000 | RDP-Tcp#10 | 2021-02-02T16:32:07.000 |
2021-02-02T14:59:04.000 | RDP-Tcp#27 | 2021-02-02T17:36:39.000 |
2021-02-02T12:19:51.000 | RDP-Tcp#10 | 2021-02-02T16:28:41.000 |
| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name
No, this is not generating the expected output. There are more than 200 session names which doesnot generate in any particular order.