Transaction Duration Duplicated due to multiple same event

[YoussefB]

Hello,

I'm trying to get the duration of a transaction starting with "green" and stopping with "red" :
The problem is that when i have data like this :

• time_001 Green
• time_002 Green
• time_003 Red
• time_004 Red
• time_005 Green
• time_006 Red
• time_007 Green
• time_008 Green
• time_009 Red

The calculated duration is ko because of the duplicated events.
This is my search query :
host="Data_Host" "Connected"
| rex ="Host (?.) - (?.)"
| transaction host startswith="*Green" endswith="Red"
| stats sum(duration) as "uptime_duration" by ligneNum
| convert timeformat="%d/%m/%y-%H:%M:%S" ctime(_time) AS "uptime_duration"
| fieldformat uptime_duration=tostring(uptime_duration,"duration")

I want my transactions to ignore the same redondant successif colors.
the result should be something like :
- time_001 Green
- time_003 Red
- time_005 Green
- time_006 Red
- time_007 Green
- time_009 Red

[YoussefB]

Hello,

I already tested : dedup color
But the result is not what i expected.
can you give more informations about dedup filters ?

[davebrooking]

I doubt if this is the most elegant way, it may not even be a correct way (reading the documentation dedup should keep the most recent event) but using reverse prior to the dedup seems to keep the events you want (if time_001 is earlier than time_002).

Try something like
...
| rex ="Host (?.) - (?.)"
| reverse
| dedup color consecutive=t
| sort -_time
| transaction host startswith="Green" endswith="Red*"
| ...

Dave

[ahrefai]

try dedup; a filtering command for removing redundunt data that match specific criteria