Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Find events either side of a matched event

$
0
0
I am trying to find the best way to identify the event before and after a matched event for each SessionID Example data; time | SessionID | UserID | Match | Data 12/08/2018 11:12:27 | 1 | 123 | Y | a 12/08/2018 11:12:28 | 1 | 123 | N | b 12/08/2018 11:12:29 | 2 | 789 | Y | c 12/08/2018 11:12:30 | 1 | 321 | N | d 12/08/2018 11:12:31 | 1 | 321 | Y | e 12/08/2018 11:12:32 | 2 | 987 | N | f 12/08/2018 11:12:33 | 1 | 123 | N | g 12/08/2018 11:12:34 | 1 | 321 | N | h 12/08/2018 11:12:35 | 2 | 987 | N | i 12/08/2018 11:12:36 | 1 | 321 | N | j 12/08/2018 11:12:37 | 1 | 321 | N | k 12/08/2018 11:12:38 | 2 | 987 | Y | l 12/08/2018 11:12:39 | 2 | 789 | N | m 12/08/2018 11:12:40 | 1 | 123 | N | n 12/08/2018 11:12:41 | 1 | 123 | N | o 12/08/2018 11:12:42 | 2 | 789 | N | p 12/08/2018 11:12:43 | 1 | 321 | N | q 12/08/2018 11:12:44 | 1 | 123 | Y | r And the data i am trying to identify should look like this; time | SessionID | UserID | Match | Data 12/08/2018 11:12:27 | 1 | 123 | Y | a 12/08/2018 11:12:28 | 1 | 123 | N | b ------------------------------------------------------- 12/08/2018 11:12:29 | 2 | 789 | Y | c 12/08/2018 11:12:32 | 2 | 987 | N | f ------------------------------------------------------- 12/08/2018 11:12:30 | 1 | 321 | N | d 12/08/2018 11:12:31 | 1 | 321 | Y | e 12/08/2018 11:12:33 | 1 | 123 | N | g ------------------------------------------------------- 12/08/2018 11:12:35 | 2 | 987 | N | i 12/08/2018 11:12:38 | 2 | 987 | Y | l 12/08/2018 11:12:39 | 2 | 789 | N | m ------------------------------------------------------- 12/08/2018 11:12:43 | 1 | 321 | N | q 12/08/2018 11:12:44 | 1 | 123 | Y | r

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>