Ahhhhhhh. Now I get it. Thanks much! ... View more

I agree with @bbingham; why are you using | search * ? Try without it like this: index=myIndex | transaction myId maxspan=30m startswith="MsgNo=0" endswith="Hang up" Also try this: index=myIndex | stats list(_raw) by myId ... View more

Hey guys I have a follow up question similar to this ask. I'm familiar with how transaction work, but i'm having fits trying to find or calculate the difference between duration events. Transaction groups "like" events, then sums the time within that event grouping. Ok, enough of a rehash of the manual. My question is this. has someone come up with a way to find the duration "between" the durations? Here is my result set i'm working with. The ask is how do I get a running total of the difference 1 and 2, then 3 and 4. Of course i'll want to display this in my chart as well:D Here's what I have so far - eio | rex "(?i)] [(?P [^\ ]+)\s+] [(?P [^\ ]+)" | transaction stateio startswith="issuedio=PauseIO" endswith="issuedio=ResumeIO" | eval durationstr=tostring(duration,"duration")| rename durationstr as "PauseIO Durations" | table"PauseIO Durations", _time 1 [requested ] [ResumeIO Live] [completed ] [ResumeIO Live] duration=18 2 [requested ] [PauseIO Live] [completed ] [PauseIO Live] duration=17 3 [requested ] [ResumeIO Live] [completed ] [ResumeIO Live] duration=18 4 [requested ] [PauseIO Live] [completed ] [PauseIO Live] duration=17 Thanks in advance. ... View more