I would like something like a stats command that groups events only if they form a contiguous run of a particular field. Suppose I have a sequence of events that have a field called 'name' that appears in the following time-ordered sequence: A,A,A,A,B,C,B,Y,Y,Y,A,A,A,B,B,B. I would like to do something like:
| stats-like-command count, min(_time), max(_time) by name
This should produce something like:
A, 4, time1, time2
B, 1, time3, time4
C, 1, time5, time6
B, 1, time7, time8
Y, 3, time9, time10
A, 3, time11, time12
B, 3, time13, time14
It shouldn't matter how much time is between the events, I just want to collapse based on "runs" within the sequence of events.
... View more