Following query with Transaction without endswith
host=phenix ("Scheduler started" OR "Scheduler stopped" OR "Restarting Protocol" OR "Stopping Protocol" OR "Protocol complete. Process") | transaction date_month date_mday startswith=("Restarting" OR "started")| stats sum(duration) AS dur by date_mday date_month| eval durInHr=dur/3600
returns
date_mday ____________ date_month ________________ dur ____________ durInHr
30 ____________ april ____________ 34143 ____________ 9.484167
When added endswith option:
host=phenix ("Scheduler started" OR "Scheduler stopped" OR "Restarting Protocol" OR "Stopping Protocol" OR "Protocol complete. Process") endswith="stopped" | transaction date_month date_mday startswith=("Restarting" OR "started")| stats sum(duration) AS dur by date_mday date_month| eval durInHr=dur/3600
returns
date_mday ____________ date_month ________________ dur ____________ durInHr
30 ____________ april ____________ 126135 ____________ 35.037500
I was hoping to get smaller duration using endswith, which is not the case here.
