| makeresults
| eval _raw="{
\"timeStamp\": \"Fri 2020.03.27 01:10:34:1034 AM EDT\",
\"step\": \"A\"
}
{
\"timeStamp\": \"Fri 2020.03.27 01:10:38:1038 AM EDT\",
\"step\": \"B\",
}
{
\"timeStamp\": \"Fri 2020.03.27 01:10:39:1039 AM EDT\",
\"step\": \"C\"
}
{
\"timeStamp\": \"Fri 2020.03.27 01:10:40:1034 AM EDT\",
\"step\": \"D\"
}"
| rex max_match=0 "\"timeStamp\":\s*\"(?<timeStamp>[^\"]+)\""
| rex max_match=0 "\"step\":\s*\"(?<step>[^\"]+)\""
| eval _counter=mvrange(0,mvcount(step))
| stats values(*) as * by _counter
| foreach *
[ eval <<FIELD>> = mvindex('<<FIELD>>' , _counter) ]
| fields - _*
| eval _time=strptime(timeStamp,"%a %Y.%m.%d %I:%M:%S:%4N %p %Z")
| delta _time as diff
| fillnull diff
| eval session = 1
| stats list(*) as * by session
... View more
