Hi,
Our systems have multiple order records as XML transactions and each order can have multiple events on different dates. I want to search for orders that have had specific event codes and display a table to show the dates when each event code happened for that individual order.
Index name is "xmlogs". Each XML has 'order ref', 'event date' and 'event code'. My search needs to be limited to event_code of 1001 or 1002 or 1003.
Input XML looks like:
<orderref>123456</order_ref>
<evendate>2021-10-01T10:31:13</eventdate>
<eventcode>1001</eventcode>
Similar XML will be for event 1002 etc.
I want output to look like:
orderref | 1001 | 1002 | 1003 |
123456 | 01/10/2021 | 04/10/2021 | |
789123 | 05/10/2021 | 08/10/2021 | 13/10/2021 |
Any help will be much appreciated.
Assuming you have already extracted the fields
| where eventcode=1001 OR eventcode=1002 OR eventcode=1003
| xyseries orderref eventcode eventdate