index="abcd" | eval _time = strptime(TS_Changed_At,"%d/%m/%Y %H:%M") | sort 0 ID _time | dedup ID _time | eventstats last(Status) as current_status by ID | where current_status="AAA" OR current_status="BBB" OR current_status="CCC" | streamstats current=f window=1 values(Status) as prev_status by ID | where NOT Status=prev_status | eval Cal= if(Status="CCC" AND (NOT prev_status="AAA " AND NOT prev_status="BBB"),substr(TS_Last_Status_Change,1,16),if(Status="BBB" AND NOT prev_status="AAA",substr(TS_Last_Status_Change,1,16),if(Status="AAA",substr(TS_Last_Status_Change,1,16),""))) | where NOT Cal="" | eventstats max(eval(strptime(Cal,"%d/%m/%Y %H:%M"))) as max_ by ID | where max_ = strptime(Cal,"%d/%m/%Y %H:%M") | table ID Cal
... View more