Hi @Crabbok Check out the following - I think this should solve your usecase here, note that I have avoided transaction because its a pretty terrible command to use - I'd only recommend it if you a...
See more...
Hi @Crabbok Check out the following - I think this should solve your usecase here, note that I have avoided transaction because its a pretty terrible command to use - I'd only recommend it if you absolutely have to! Instead we can leverage stats. Ive applied some further logic here to split events into individual sessions, so that if a user joins and leaves multiple times in the search window then it will show multiple sessions - see the example below: The full SPL for this for you to try is: | makeresults format=csv data="Message,UserXXID,_time
Info: User USER001 has joined the event session.,USER001,2025-05-06 22:20:03
Info: User USER002 has joined the event session.,USER002,2025-05-06 22:21:43
Info: User USER001 has left the event session.,USER001,2025-05-06 22:36:43
Info: User USER003 has joined the event session.,USER003,2025-05-06 22:40:03
Info: User USER002 has left the event session.,USER002,2025-05-06 22:53:23
Info: User USER003 has left the event session.,USER003,2025-05-06 23:01:43
Info: User USER001 has joined the event session.,USER001,2025-05-06 23:18:23"
| rex field=Message "has (?<action>[a-zA-Z]+) the event session"
| eval {action}_time=_time
| sort UserXXID
| streamstats count as userEventNum min(joined_time) as session_joined_time, max(left_time) as session_left_time by UserXXID reset_after="action=\"left\""
| eval action_time=strptime(_time, "%Y-%m-%d %H:%M:%S")
| stats range(action_time) as sessionDurationSeconds, values(action) as actions, max(_time) as session_left_time by UserXXID session_joined_time Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing