Is there any way to set the semi-permanent variables exists to 0 until a specific event comes up?

[hermitfeather]

Hello!

I currently have this eval in a search of mine:

| eval exists=if(like(_raw, "%xa recovery%"), 0, 1)

Is there any way to set the variable exists to 0 until a specific event comes up? What I'm trying to accomplish is like this...

If event contains(xa recovery) exists=0 until event contains(System READY) then exists=1.

Thank you!

[ITWhisperer]

Do you mean something like this

| eval exists=if(like(_raw, "%xa recovery%"), 0, 1)
| streamstats max(exists) as exists

Note that streamstats works through the pipeline of events as they come, which is often (depending on the rest of the search) in reverse chronological order i.e. most recent first, so, depending on what you mean by "until", you may need to sort your events into chronological order prior to the streamstats.

[hermitfeather]

Most recent first is what I want, I think. What I mean by until is for that variable to be set to 0 once an event with xa recovery is received then that variable stays the same regardless of the other events that are received until an event is received that has System READY in the event then it'll go back to the original value 1. I'll try what you have there with streamstats.