教えてください。
STARTとENDの時間範囲のあるCSVを作成し、その範囲内にあるイベントを数えたいのですが、どのようにクエリを書けばよいでしょうか
<pre>
started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00
</pre>
sample:
| makeresults
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""
format使用することで、検索範囲を上記の通り作成することができます。
index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]
こちらではどうですか?
sample:
| makeresults
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""
format使用することで、検索範囲を上記の通り作成することができます。
index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]
こちらではどうですか?