The query won't work for me
Here my business modal starts, eventName=505 reference ID will create here from 505 "EventStreamData start time " and with the same reference ID some of the requests only going through eventName=507, here(507) verification status=PROCESSED then "EventStreamData end time " end time from here
both starting times to end time average Time needs to be displayed
Index= caudit eventName=505
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.requestContext.eventStartTime=*
Index= caudit eventName=507
|search "EventStreamData.args.verificationId"="8387be8f"
|EventStreamData.response.verificationStatus"=PROCESSED
|EventStreamData.requestContext.eventEndTime=*
... View more