Hello!
I need to make graph path for the field "Status".
1st step:
time | Name | Status |
... | Name1 | A |
... | Name2 | B |
... | Name1 | C |
... | Name1 | A |
... | Name2 | A |
...|sort 0 Name time
time | Name | Status |
... | Name1 | A |
... | Name1 | C |
... | Name1 | A |
... | Name2 | B |
... | Name2 | A |
3rd step:
time | Name | Status | Previous_Status |
... | Name1 | A | C |
... | Name1 | C | A |
... | Name1 | A | |
... | Name2 | B | A |
... | Name2 | A |
So, how can i make the 3rd step?
Or suggest another way to solve this problem?
Thank you
Hi Timeago
you should be able to get this by using streamstats
The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.
Combined with eval you can make new fields and compare them to each other.
Hope this helps to get you started...........
cheers, MuS
Hi Timeago
you should be able to get this by using streamstats
The streamstats command, similar to the stats command, calculates summary statistics on search results. Unlike, stats (which works on the results as a whole), streamstats calculates statistics for each event at the time the event is seen.
Combined with eval you can make new fields and compare them to each other.
Hope this helps to get you started...........
cheers, MuS
Hmmm.. maybe. try this as a start.. not tested..
... | sort +Name, +_time | streamstats window=1 current=false first(Status) as Previous_Status
/K