For each Digit I have below (Digit 0,2,3,4,5,7,8) I want to calculate the difference in time between the TXN endtime and the FW endTime for that digit. How can i group this new calculated one value for each digit?
index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| table jobName Digit endTime endTimeEpoch status
| sort -Digit
extract the "digit" value
|rex field=Digit "Digit (?P<digitValue>\d)"
rewrite _time to be endTimeEpoch
|eval _time = endTimeEpoch
use transaction to group them
|transaction digitValue startswith=*FW endswith=*TXN
retable
| table jobName Digit digitValue endTime endTimeEpoch status duration
So in full:
index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
extract the "digit" value
|rex field=Digit "Digit (?P<digitValue>\d)"
rewrite _time to be endTimeEpoch
|eval _time = endTimeEpoch
use transaction to group them
|transaction digitValue startswith=*FW endswith=*TXN
retable
| table jobName Digit digitValue endTime endTimeEpoch status duration
So in full:
index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
Thank you!