Hi all, I have the following data and I need some help to progress further. I have fields: _time uniqueId action user host The events are paired. Both events share the same uniqueId, user and host, and each will have an "action" which is "action connect" or "action disconnect". I am trying to create a single 5mins span timechart, showing number of "paired events" and the average duration for that 5 mins. I am able to do that with separate queries but I am unable to join them into one, or find a better query. index=myindex action=\*action* | stats min(_time) as Start, max(_time) as End, by uniqueId user host | eval Duration = tostring((End - Start), "duration") | eval Start_time=strftime(Start,"%F %T") | eval End_time=strftime(End,"%F %T") | where Duration!="00:00:00" | table uniqueId user host Start_time End_time Duration index=myindex action=\*action* |bin _time span=5m | stats count(uniqueId) as Sessions by _time Thanks ... View more

Hi, need some expert help tuning a search query focused only on ITSI users per week. I have the following query but it is running really slow. index="_internal" host= app=itsi NOT user="splunk-system-user"| timechart span=1d count as count_user by user usenull=f Any suggestions are welcomed. Thanks. ... View more