| makeresults
| eval _raw="Connection: lost
Connection: finding
Connection: found
Unneeded data
Connection: misc.
Connection: misc.
unneeded data
Connection: lost
Connection: finding
Connection: found
Unneeded Data
Connection: lost
Connection: finding
Connection: still finding"
| makemv delim="
" _raw
| rename _raw as raw
| mvexpand raw
| rename raw as _raw
`comment("this is your sample, from here, the logic")`
| search "Connection" NOT "misc"
| streamstats count(eval(searchmatch("lost"))) as session
| where session > 0
... View more