Hi yuanliu Firstly thanks for looking into it and helping with the SPL query. It was pleasing to see someone responding I felt like I should buy a coffee 🙂 I apologize for my mistake of mentioning streamstats. I think i did not put my original request properly, let me try again. so when the search is executed (now), we need data from two point in times, from now and two hours ago. If I'm running a search at 16:05:02, first set will have data values of pv_number (example ext034) and "state" value (6) at that point-in-time (from two hours ago, so 14:05:02) In the second set of data values, pv_number (if its still exist in this point of time @ 16:05:02) AND still has "state" value (6), then want to see the table showing pv_number and both times along with previous and current state. Hope It helps..
... View more
