Where log matching grouping operator doesnt exist in time range
Hi! Any thoughts on how I would filter in Sumologic all matching logs such that aggregating by a field, there is no matching log with the same field value greater than 15 minutes ago?
For example lets say we have these logs for the last hour, with two fields: id, and timestamp:
- id 1, 30 minutes ago
- id 2, 10 minutes ago
- id 1, 5 minutes ago
because "id 1" has a matching log from 30 minutes ago, i want to also exclude all logs "id 1", including the log from 5 minutes ago from the result. But because "id 2" doesn't have a matching log like from greater than 15 minutes ago, I want to keep that result.
Thanks for the guidance!
Please sign in to leave a comment.
Comments
1 comment