How to group events by the same field value?

[TBo123]

Hello,

I hope there is someone who can help me solve this problem.
I'd like to know how to group events shown as follow.

Currently my log looks like this:

time ........... code

1.1.2009 .... A

1.2.2009 .... A

1.3.2009 .... B

1.4.2009 .... A

1.5.2009 .... B

1.6.2009 .... B

1.7.2009 .... B

What I want to get is something like this:

time ........... code

1.1.2009 .... A

1.3.2009 .... B

1.4.2009 .... A

1.5.2009 .... B

The task would be to group events as long as they have the same code and to start a new group if there is some other value in code. I tried to solve this problem with transaction and startswith and endswith but in my log there are many more different codes then in this example, so I don't know how to use it. Who can help me?

Thank you

[somesoni2 · Accepted solution]

Try something like this

your base search giving _time and code fields | streamstats current=f window=1 first(code) as prevcode | where isnull(prevcode) OR code!=prevcode

[TBo123]

Exactly what I needed, thank you so much..