In below example I want only count of "a" as he has not paid till the end. And also the data entries are many which cannot be counted,below is only a small part of it.
Count should be based on customer, only those customers count should be given which have not paid till the end and if paid once its previous unpaid should not be consider.
Pending and paid invoices count gets change when invoices paid by customer
E.g. 31st Jan 2020 customer has not done payment so I am making entry for that invoice as pending so this count will display on pending invoices as 1 and invoices paid as 0 and once Customer has paid on feb 1st week then from pending invoices count will change back to 0 and paid invoices to 1
date | customer | payment_status |
01/31/2020 | a | unpaid |
01/31/2020 | b | unpaid |
01/31/2020 | c | paid |
02/31/2020 | a | unpaid |
02/06/2020 | b | paid |
02/26/2020 | c | paid |
03/30/2020 | a | unpaid |
03/30/2020 | b | paid |
03/30/2020 | c | paid |
Any help is appreciated.
| makeresults
| eval _raw="date customer payment_status
01/31/2020 a unpaid
01/31/2020 b unpaid
01/31/2020 c paid
02/31/2020 a unpaid
02/06/2020 b paid
02/26/2020 c paid
03/30/2020 a unpaid
03/30/2020 b paid
03/30/2020 c paid"
| multikv forceheader=1
| table date customer payment_status
| stats dc(payment_status) as flag count(eval(payment_status="unpaid")) as unpaid by customer
| where flag = 1 AND unpaid > 0
As I have mentioned that this in only a small part of my csv file. There are 300 entries I can't write 300 date customer in my query. Is there other way?
>other way.
why? Isn't stats and where good enough?
They are but what I am saying is that i cant write for 300 entries.
recommend:
your search
| stats dc(payment_status) as flag count(eval(payment_status="unpaid")) as unpaid by customer
| where flag = 1 AND unpaid > 0