How to get exception data for multiple lines of Get and Update logs

[EricMonkeyKing]

Hi community, can anyone help me figure out the log which Get incorrect data after Update(both get and update will log the request and response). In my case, the data can be updated multiple times. I need to guarantee all the Get can get correct data.

For example, there are 5 rows log:

1. Update A = 5,

2. Get A = 5,

3. Get A = 6,

4. Update A = 6, 

5. Get A = 6;

These logs are sorted based on time. Obviously the result obtained in the third row is incorrect, it should return A = 5.

The sample data is like:

id	value	time	operation
124945912	FALSE	1718280482	get
124945938	FALSE	1718280373	get
124945938	FALSE	1718280373	update
124945938	null	1718280363	get
124945937	FALSE	1718280348	get
124945937	FALSE	1718280348	update
124945937	null	1718280337	get
124945936	FALSE	1718280330	get
124945936	FALSE	1718280330	update

Both id=124945937 and id=124945936 are correct since the obtained value after Update operation is same as Update value(false) even though the previous obtained value(null) which is before Update operation does not equal to Update value. Can ignore the Get operation if there is no Update operation before. Can anyone help? Thanks in advance^^

[P_vandereerden · Accepted solution]

Something like this should work if the timestamps are unique for each id:

index=mylogs
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

With sample data (adjusted slightly for demo purposes and unique timestamps):

| makeresults | eval id=124945912 | eval value="FALSE" | eval _time=1718280482 | eval operation="get"
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="get"]
| append [| makeresults | eval id=124945938 | eval value="FALSE" | eval _time=1718280373 | eval operation="update"]
| append [| makeresults | eval id=124945938 | eval value="null" | eval _time=1718280363 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280350 | eval operation="get"]
| append [| makeresults | eval id=124945937 | eval value="TRUE" | eval _time=1718280349 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="FALSE" | eval _time=1718280348 | eval operation="update"]
| append [| makeresults | eval id=124945937 | eval value="null" | eval _time=1718280337 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280331 | eval operation="get"]
| append [| makeresults | eval id=124945936 | eval value="FALSE" | eval _time=1718280330 | eval operation="update"]
| sort + _time
| streamstats latest(eval(if(operation="update",value,NULL))) as Current by id 
| eval STATUS=case(isnull(Current),"OK",Current=value,"OK",1=1,"FAIL")

[EricMonkeyKing]

That perfectly resolved my problem. Many thanks!!!