This is one of few occasions that transaction command is appropriate. Something like | rename "Log text" as LogText
| transaction maxspan=120s startswith="LogText = disconnected" endswith="LogTe...
See more...
This is one of few occasions that transaction command is appropriate. Something like | rename "Log text" as LogText
| transaction maxspan=120s startswith="LogText = disconnected" endswith="LogText = connected" keeporphans=true
| where isnull(closed_txn) Your mock data would give LogText Row _time closed_txn duration eventcount field_match_sum linecount disconnected 5 2024-12-17 08:10:30 disconnected 4 2024-12-17 08:00:10 Here is an emulation of your mock data. | makeresults format=csv data="Row, _time, Log text
1, 7:00:00am, connected
2, 7:30:50am, disconnected
3, 7:31:30am, connected
4, 8:00:10am, disconnected
5, 8:10:30am, disconnected"
| eval _time = strptime(_time, "%I:%M:%S%p")
| sort - _time
``` data emulation above ``` Play with the emulation and compare with real data.