unfortunately this does not work for me either ERROR: LDAP modul load failed with error libsasl2.so.2: cannot open shared object file: No such file or directory! ... View more

This example also just returns all the results from the first subsearch, even though both searches return the exact same results ... View more

Thanks, however I am not sure how the following is supposed to work | rename COMMENT as "Put the keys back where they are supposed to be" | rename YourKeyFIelds_New as YourKeyFIelds | rename COMMENT as "Copy the fields forward by key" | streamstats current=f last(*_New) as *_Old by YourKeyFIelds When I rename my fields back, the streamstats has nothing to compare as there now are now no *New fields in the data. ... View more

Well basically, its as easy as the following Taking the following event fields returned timestamp, id, priority, assigned, team, status (example return) 9/17/2018 8:57:00, 524441, 1, triage, web, new 9/17/2018 9:57:00, 524441, 1, tim, service, open 9/17/2018 10:57:00, 524441, 2, tim, service, open 9/17/2018 11:57:00, 524441, 2, tim, service, in_progress 9/17/2018 12:57:00, 524441, 2, joe, service, closed I would like to display as _time, modified_field, new_value 9/17/2018 9:57:00, id, 524441 priority, 1 assigned, triage team, web status, new 9/17/2018 9:57:00, assigned, tim team, service status, open 9/17/2018 10:57:00......etc. ... View more

I am still unable to get this to work. It never identifies any concurrent durations. anything you can see wrong here? These would be events ranging between 15 minutes and possibly many hours. index=pd "log_entries{}.incident.status"=resolved "log_entries{}.incident.priority.name"=P1 | rename log_entries{}.* as * | dedup incident.incident_number | eval Start=strptime('incident.created_at',"%Y-%m-%dT%H:%M:%SZ") | eval Stop=strptime('incident.last_status_change_at', "%Y-%m-%dT%H:%M:%SZ") | eval duration = Stop - Start | eval _time=Stop | appendpipe [| stats min(_time) as mintime max(_time) as maxtime | rename COMMENT as "set your duration here" | eval duration=900 | eval mintime= duration*floor(mintime/duration) | eval Start=mvrange(mintime,maxtime+duration,duration) | table Start duration | mvexpand Start | eval _time=Start | eval KeepMe=duration ] | concurrency duration=duration start=Start | search isnotnull(KeepMe) | stats count(eval(concurrency>1)) AS concurrency max(KeepMe) as duration | eval onSeconds = duration * concurrency ... View more