thanks that was it.  Now the query is not yielding any result still - curious where does it "join" by trace_id? is `by trace_id` on stats enough? ... View more

I get -  Error in 'stats' command: The eval expression for dynamic field 'if("tags.path"="/enroll" AND "response"=success, _time, null())' is invalid. Error='Type checking failed. The '==' operator received different types.'. But if I do this  "tags.path"=="/enroll" AND "response"=="success" it gets past that error and runs. So to explain it say the csv has - student1 and student2 I'd like to get the latest enrollment date for those 2 students.  Now, since index="main" app="student-api" "tags.path"="/enroll" "response"=success doesn't allow us to filter by student_id, I am trying to get the trace_id from that query, join it with index="main" app="student-api" (which allows us to filter by student_id)  based on that trace_id and then use the 2 ids from the csv to filter on that result. ... View more

We'd like to get only the latest enrollment success dates for students in the csv ... View more

also inside if should those be == vs =? ... View more

index="main" app="student-api" tags.student_id gives you a student id AND a trace_id? Correct index="main" app="student-api" "tags.path"="/enroll" "response"=success gives you a trace_id but no student id Correct What information do you need from this event if you plan to get the latest timestamp of enrollment from the CSV? I get only the student_id from csv I want the latest date of successful enrollment  for a given student id. I'll give your query a try - thanks ... View more

I did - thanks ... View more

I could fix it - thanks @ITWhisperer - your solution pointed me to the right direction ... View more

Also I just tried    index="main" app="student-api" tags.studentId=3B70E5 (message="Id and pwd entered correctly" OR "tags.decision"=SOP_REQUIRED) | stats latest(_time)   and the timestamp came up like 1675785328.602059 Do we need to do some conversion? ... View more

thanks - getting closer - I tried  index="main"app="student-api" (message="Id and pwd entered correctly" OR "tags.decision"=SOP_REQUIRED) [|inputlookup students.csv | fields student_id | rename student_id as "tags.studentId"] | stats latest(eval(if(message=="Id and pwd entered correctly",_time,null()))) as first_timestamp latest(eval(if('tags.decision'=="SOP_REQUIRED",_time,null()))) as second_timestamp by tags.studentId  the studentId is showing up but the timestamps are empty - I ran the query separately and I see the events showing up as expected. ... View more

thanks - this is not yielding results - I think we've to use the student_id in csv - where are we doing that? (I mean the csv header is student_id while the query needs tags.studentId) ... View more

Thanks - I meant I've a csv with student ids that I'd like to use as input to the query ... View more

@gcusello thoughts on this one? ... View more