I have two events one is
Index=x source type= xx "String" extacted fields s like manid,actionid,batch I'd
2nd event
Index=y source type=y " string recived" extacted fields like manid ,actionid
Calculate the time from 2nd event -1 event .
While calculating the time mandid should same
Something like
(index=x source type= xx "String") OR (index=y source type=y " string recived")
| stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid
| eval duration = max(time) - min(time)
Something like
(index=x source type= xx "String") OR (index=y source type=y " string recived")
| stats values(_time) as time values(actionid) as actionid values(batchid) as batchid by manid
| eval duration = max(time) - min(time)
Result getting fine but want based on the below condition
Calculate the diffe bw start event and end event grouped by manid. And count number mandate exceeding different above 30 seconds
Then you add calculation based on duration.
| eval excessive = if(duration > 30, duration, null())
| stats count(excessive) as excess_count avg(excessive) as excess_avg by manid