Hello,
Here is my question:
Suppose I have 4 fields, and I want to find the recorded time of each step using conditions of the fields.
But, because there is different time and multiple fields involved, I cannot seem to get the result I want
can someone please help me?
try this:
| eval step1_time = case(jobtype=delivery AND status=pending,Time1)
| eval step2_time = case(jobtype=delivery AND status=pending,Time1)
| eval step3_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2)
| eval step4_time = case(jobtype=delivery AND (status=delivered OR status=delivery_failed),Time2)
| eval step5_time = case(jobtype=delivery AND status=deposited,Time2)
| eval step6_time = case(jobtype=delivery AND status=deposit_failed,Time2)
| stats earliest(step1_time) as step1 latest(step2_time) as step2 earliest(step3_time) as step3 latest(step4_time) as step4 earliest(step5_time) as step5 latest(step6_time) as step6