calculate min and max time of event

[sarit_s]

hello
im trying to calculate min and max time of event (the time when the event started and when its ended)
when im adding my calculation to the query im loosing the results of the rest of the query and getting only the result of the time calculation...
what am i missing ?

index=prod eventtype="csm-messages-dhcpd-lpf-eth0-listening" OR eventtype="csm-messages-dhcpd-lpf-eth0-sending" OR eventtype="csm-messages-dhcpd-send-socket-fallback-net" OR eventtype="csm-messages-dhcpd-write-zero-leases" OR eventtype="csm-messages-dhcpd-eth1-nosubnet-declared"

| transaction maxpause=2s maxspan=1s maxevents=5
| stats first(_time) as min_time, last(_time) as max_time
| table _time,eventcount, eventtype, tail_id, kafka_uuid,min_time,max_time

| foreach eventtype
     [eval flag_eventtype=if(eventcount!=5,"no", "yes")]

[to4kawa]

transaction has only one _time

[sarit_s]

so i can i do it differently ?

[to4kawa]

Why don't you try using a command other than transaction ?
or extract _time by using rex again.

[sarit_s]

im open to try, i just don't know what and how 🙂

[to4kawa]

check reference:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

[sarit_s]

it looks like using transaction is the right way.. so how can i use rex to extract _time ?

[to4kawa]

I don't know, check your log.