I have this code that shows me the start and end times of runs of a program: index=index1 source=source1 | transaction startswith="Execution started" endswith="Execution ended" | eval start_time=_time | eval end_time=_time + duration | table start_time end_time I also have this search which searches for errors (in a different log file): search index=index1 source=source2 severity=ERROR What I need is to add another column in the table that shows the runs of the program that would show how many errors occurred during the run of the program. For example, appendcols like this: <times_search> | appendcols [ search <error_search> | stats count as errors by _time ] But this has two problems: 1) it's by _time when I need it to be by run. I need the amount of all the errors that occurred between start_time and end_time.. 2) it's not sorted like I need it to be. As it says in the documentation, it puts the first result at the first row and the second in the second and so on How do I achieve this?
... View more