Time between events

[dturner83]

We're trying to calculate the time between a users 1st event on our site and their 3rd event on our site. We can use transaction for SessionId or X_Forwarded_For for tracking purposes but I've got no idea how to grab 1st event and 3rd event.

I use the following to get their first and last easy enough.
[search] | stats earliest(time) as start, latest(time) as stop by X_Forwarded_For, ASP_NET_SessionId

I'm assuming using transaction on X_Forwarded_For or ASP_NET_SessionId would work I'm just not sure how to grab the time difference between the first and 3rd events.

[somesoni2]

Try this. (I am assuming when you say 1st and 3rd for a user, mean 1st and 3rd for a session Id, please update the column if its otherwise)

your base search | streamstats count as sno by ASP_NET_SessionId | where sno=1 OR sno=3 | fields - sno | further search command

At this point of time your should get 1st and 3rd event for a ASP_NET_SessionId. You can add more combination if applies. Use transaction (or stats command how you used in your question) to get the duration.

[richgalloway]

How about inserting 'head 3' before your 'stats' command?

[dturner83]

head 3 will grab the last 3 events and then do the stats command on those results. Next logical step there for me would be head 3 by X_Forwarded_For but unfortunately you can't do that with the head command.