I have a data like I am searching with a request ID
and I get below data like
time 1: request id=1 account details and elapsed time
time 2 request id=1 account codes
time 3 request id= 1 viewname and view 2
time 1: request id=2 account details and elapsed time
time 2 request id=2 account codes
time 3 request id=2 viewname and view2
I want like the below
request id accountdetails accountcd viewname view2
1 abc abc_cd skyview earthview
2 xyz xyz_cd sky1view earthview1
can you please help how can i achive this , thanks in advance
Give this a try (adjust the field name per yours)
your base search fetching all 3 type of events
| stats values(account_details) as account_details values(accountcd) as accountcd values(viewname) as viewname values(view2) as view2 by request_id
also in above the account details contain more than 1 account details for which need those in it like all ones
Could you explain this with an example? (what you're getting right now and what you want)
what to do for date if I want to get along with above columns
Based on which time you want, you can include max(_time) as _time
OR min(_time) as _time
in the stats.