I might be confusing myself by making this harder than it is... Say I have a log where the events are: LOGIN ACTION (1) ACTION (2) LOGOUT LOGIN ACTION (3) ACTION (4) ACTION (5) LOGOUT What I would like is to be able to display all the ACTION events that happened between just the first LOGIN/LOGOUT pair and output: ACTION (1) ACTION (2) This is in a dashboard, and I've got dropdowns to identify each unique LOGIN event, those are working just fine. I tried a transaction, but I think that might be the wrong tool for the job, and I'm worried I got too fixated on that and am now missing the forest for the trees. What I want is all ACTION events bounded by the selected LOGIN and the next subsequent LOGOUT. So in terms of metacode I want something along the lines of... | search ACTION earliest=LOGIN._time latest=LOGOUT._time Does that make sense? Am I approaching this from the wrong direction? Or is this just a bit of search code I haven't figured out?
... View more
