fantastic... thanks very much.... i was going to go along the spath route just for quickness but that would mean writing out each variation by hand... this is such an efficient was to searchl.... KUDOS ... View more

try foreach .... |foreach multiyearfield* [ eval "<<FIELD>>"="true"] ... View more

Yep. Write it up and accept it. ... View more

index=mymainindex sourcetype=mymainsourcetype starttime=01/01/2018:00:00:00 endtime=02/01/2018:00:00:00 clientIP=* | stats count(_time) as appear_count min(_time) as first_appear max(_time) as last_appear range(_time) as duration list(_time) as time_list by clientIP | foreach *_appear [ fieldformat <<FIELD>>=strftime(<<FIELD>>,"%c")] You should check the status of clientIP with this search and then consider the next search method. ... View more

Like this (assuming that you already have a JSESSIONID field or something like user that you can use for that): | makeresults | addinfo | foreach info_*_time [ eval <<FIELD>> = strftime(<<FIELD>>, "%m/%d/%Y:%H:%M:%S") ] | map search="|gentimes increment=1m start=$info_min_time$ end=$info_max_time$" | streamstats count AS _serial | eval JESSIONID=if(_serial<=30, "1", "2") | streamstats count AS _serial BY JESSIONID | eval URL=case(_serial<5 OR _serial>25, "ignore" . _serial, _serial=="5", "start", _serial=="25", "end", true(), "include" . _serial) | rename starttime AS _time | table _time JESSIONID URL | sort 0 -_time | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | streamstats count(eval(match(URL, "end"))) AS endID BY JESSIONID | reverse | streamstats count(eval(match(URL, "start"))) AS startID BY JESSIONID | where endID==startID | stats dc(URL) count(URL) BY JESSIONID ... View more

@stephenreece Try |rex field=errors max_match=0 "(?<Errors>\d{5}):" ... View more

@woodcock - sometimes I do. This time, not so much. ... View more

Try something like this... index="foo1" your other search terms not including sessionID or any time references [ your search that takes the lookup and gets the events with those SessionIDs | fields _time SessionID | stats min(_time) as earliest max(_time) as latest by SessionID ] | your search terms that process the events returned. The search in square braces will equate to a complex test that looks like .... ( ( SessionId="value1" AND earliest="lowtime1" AND latest="hightime1" ) OR ( SessionId="value2" AND earliest="lowtime2" AND latest="hightime2" ) OR ( SessionId="value3" AND earliest="lowtime3" AND latest="hightime3" ) OR ... ) ... View more