How do I list those events within a set of events(say expand the below query) wherein say 2 consecutive's event time difference is more than 0.5 secs?
index=index1 * "orderid"
thank you
Simple example here
index=index1 * "orderid"
| delta _time as timeDiff
| where timeDiff < -0.5
That is simply selecting events where the earlier event is more than 0.5 seconds before the current event, but not sure if that's exactly what you're after
@bowesmana , lovely thanks a lot!
Simple example here
index=index1 * "orderid"
| delta _time as timeDiff
| where timeDiff < -0.5
That is simply selecting events where the earlier event is more than 0.5 seconds before the current event, but not sure if that's exactly what you're after