I have a search where I want to get the first time an event comes in from a source, then find out the first event from that same source with a specific status. For instance, if I want to find out the first time a user logs in and then the first time he signs out to determine total sessions time. Keep in mind that there may be other events from that user during the session which are producing different stats.
What I need is the ability to find the first time using conditional min():
blah blah... | stats min(_time) as login_time, min(eval status="LOGOUT"), _time) as logout_time | ... blah blah blah
This was giving me an error:
min(eval(status=="LOGOUT", _time,NULL)) as logout_time
I think you meant:
min(if(status=="LOGOUT", _time,NULL)) as logout_time
This did not produce an error, but is not returning what I need either.