The input and output that I need are in the screenshot below:
I was able to use xyseries with below command to generate output with identifier and all the Solution and Applied columns for each status. However now I want additional 2 columns for each identifier which is: * StartDateMin - minimum value of StartDate for all events with a specific identifier * EndDateMax - maximum value of EndDate for all events with a specific identifier
index = | | stats count by Identifier, TransactionType, Status | eval TransactionType = TransactionType." (".Status.")" | xyseries Identifier, TransactionType, count | fillnull value=0
How do I embed the new columns StartDateMin and EndDateMax with query modification of above query ? One option I can think of is to separately generate identifier with startdatemin, end datemin and then again identifier with other columns and then perform a join based on identifier but would involve repetition of lot of conditions two times.
Is there an easy way out while using the above query to do the same ?