Display multiple events by dates in table format

[ezpc98]

Hi,

Our systems have multiple order records as XML transactions and each order can have multiple events on different dates. I want to search for orders that have had specific event codes and display a table to show the dates when each event code happened for that individual order.

Index name is "xmlogs". Each XML has 'order ref', 'event date' and 'event code'. My search needs to be limited to event_code of 1001 or 1002 or 1003.

Input XML looks like:

<orderref>123456</order_ref>

<evendate>2021-10-01T10:31:13</eventdate>

<eventcode>1001</eventcode>

Similar XML will be for event 1002 etc.

I want output to look like:

orderref	1001	1002	1003
123456	01/10/2021		04/10/2021
789123	05/10/2021	08/10/2021	13/10/2021

Any help will be much appreciated.

[ITWhisperer]

Assuming you have already extracted the fields

| where eventcode=1001 OR eventcode=1002 OR eventcode=1003
| xyseries orderref eventcode eventdate