Transaction after stats/table/eval/where?

[Yarsa]

Hi, is it possible to manipulate the events of a query with a transaction after using stats/table/eval/where?
the events are kept no matter what I do to them in the query, maybe they reduce in numbers but the remaining results are the important ones for a possible transaction.

For example:

source="thesource" A="enterEvent"  | stats first(_time) as firstime last(_time)  as lastime  by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff>"12" | transaction userId | table _time userId

(obviously I don't have _time anymore in my results, but can't I reuse it from the remaining events?)

[Ayn]

No, once you've run a command that transforms the results in one way or another, the following commands in the search pipeline will only see the output of that command, so for instance after running stats the following commands do not 'see' the original events.

What you could do though is to put this in a subsearch for getting the userId's that you want to report on first, and then return those to the main search where you get the times for each of those userId's:

source="thesource" A="enterEvent" [search source="thesource" A="enterEvent"  | stats first(_time) as firstime last(_time)  as lastime  by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff>"12" | fields userId] | table _time userId