So I am looking for help, I guess I just found something I can't do with Splunk... and I know I'm wrong, only I can't prove it!
It may be related to me (as I am somehow new to Splunk), so please help. Here goes:
Basically, I have events like:
Time | SessionId | State
01:00:00 | 7 | Active
01:01:00 | 7 | Disconnected
01:02:00 | 7 | Disconnected
01:03:00 | 7 | Active
What I would like is to generate a report to show actual session durations (with start time and end time), something like this:
Session 7 | State=Active | Start 01:00:00 | End 01:01:00
Session 7 | State=Disconnected | Start 01:01:00 | End 01:03:00
Session 7 | State=Active | Start 01:03:00 | End ....
I tried with streamstats, but no go, and unfortunately I am in a lack of ideas, so any help would be highly appreciated!
... View more