how to set time distance between operations in search?

[zoyaO]

Hello!
i need to find clients who had operation "registration" and within 24 hours operation "payment"
how can I set the option for search, that one operation was less than 24 hours ago?

[alacercogitatus · Accepted solution]

So here's a WAG. Search back 24 hours, transaction the events together using the keywords (I assumed these were in your data), and then filter out those with less than 2 events (registration and NOT payment within 24 hours).

your_search_terms earliest=-24h@h | transaction startswith="registration" endswith="payment" patient_id | where eventcount > 1

[dwaddle]

then filter those other activities out as part of your base search... perhaps your_search_terms that alacer points out above should include "( registraton OR payment )".

[alacercogitatus]

your_search_terms "registration" OR "payment" | transaction startswith="registration" endswith="payment" patient_id | where duration < 86400 AND eventcount > 1

[zoyaO]

this is not exactly what I'm looking for. I need to find all the customers who have in their history activity "payment" less than 24 hours after the activity "registration". and between these events may be others events (eg change of email) which should not be considered.