Ignore events within a timespan?

[bmorgenthaler]

Is it possible to drop events if they occur within a certain timespan of each other? I'm specifically looking at VMware View logs and trying to corelate external user login sessions.  Normally there is a BROKER_USERLOGGEDIN event and then AGENT RECONNECT/CONNECT events.  Unfortunately everyonce in a while there is a network hiccup and a client disconnects/reconnects without a BROKER_USERLOGGEDIN event (like the attached picture).

I want to ignore/drop any EventType=AGENT_DISCONNECT and EventType=AGENT_RECONNECT if they happen within 60 seconds.  

[MuS]

Hi bmorgenthaler ,

you can use `streamstats` to calculate the time difference and filter on that like this:

your base search here
| streamstats current=f last(_time) AS l_time last(EventType) AS l_EventType by EventType
| eval diff = _time - l_time 
| where diff < 60  AND l_EventType=="AGENT_DISCONNECT" AND EventType=="AGENT_RECONNECT" 

This might needs tuning but will give you a starting point.

Hope this helps ...

cheers, MuS