Graph path

[Timeago]

Hello!

I need to make graph path for the field "Status".

1st step:

time	Name	Status
...	Name1	A
...	Name2	B
...	Name1	C
...	Name1	A
...	Name2	A

2nd step:

...|sort 0 Name time

time	Name	Status
...	Name1	A
...	Name1	C
...	Name1	A
...	Name2	B
...	Name2	A

3rd step:

time	Name	Status	Previous_Status
...	Name1	A	C
...	Name1	C	A
...	Name1	A
...	Name2	B	A
...	Name2	A

So, how can i make the 3rd step?
Or suggest another way to solve this problem?

Thank you

[MuS · Accepted solution]

Hi Timeago

you should be able to get this by using streamstats

The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.

Combined with eval you can make new fields and compare them to each other.

Hope this helps to get you started...........

cheers, MuS

[kristian_kolb]

Hmmm.. maybe. try this as a start.. not tested..

... | sort +Name, +_time | streamstats window=1 current=false first(Status) as Previous_Status

/K