The following 6 lines of SPL produce the raw dataset you used in your stackoverflow question:
| makeresults count=1
| eval data="Login,1|Login,2|Logout,1|Logout,2|Logout,3|Logout,4|Login,3|Logout,5|Login,4|Login,5|Logout,6|Login,6|Logout,7|Logout,8"
| makemv delim="|" data
| mvexpand data
| rex field=data "(?<action>[^\,]+),(?<action_number>\d+)"
| fields - _time, data
The logic below to produces the required result. Loosely speaking, it:
Keeps a count of the active sessions (streamstats)
Ensures this does not go below zero (streamstats, eval)
Works out the next action (reverse, streamstats)
Uses logic based on session count, current action and next action to decide whether you need to use this event in your calculations (eval)
SPL:
| eval actiontype=if(action=="Login",1,-1)
| streamstats reset_after="("session_count<\"0\"")" sum(actiontype) AS session_count
| eval session_count=if(session_count==-1,0,session_count)
| reverse
| streamstats current=f global=f window=1 max(actiontype) AS next_actiontype
| eval "Flag for Deletion"=if(session_count>1 OR (session_count==0 AND next_actiontype==-1) OR (session_count==1 AND actiontype==-1),"True","False")
| reverse
| fields action, action_number,"Flag for Deletion"
... View more
