Right now I have a table with fields: DateTime, TestFeatureName and Status.
How can I create another field "Occurrence" that can count the number of occurrence for each Start-Complete as below?
DateTime | TestFeatureName | Status | Occurrence |
10.00 pm | ABC | Start | 1 |
10.20 pm | ABC | Complete | 1 |
10.40 pm | ABC | Start | 2 |
10.45 pm | ABC | Complete | 2 |
11.10 pm | DEF | Start | 3 |
11.30 pm | DEF | Complete | 3 |
Can you please try this?
YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence
My Sample Search :
| makeresults | eval _raw="DateTime TestFeatureName Status
10.00 pm ABC Start
10.20 pm ABC Complete
10.40 pm ABC Start
10.45 pm ABC Complete
11.10 pm DEF Start
11.30 pm DEF Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Can you please try this?
YOUR_SEARCH
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence
My Sample Search :
| makeresults | eval _raw="DateTime TestFeatureName Status
10.00 pm ABC Start
10.20 pm ABC Complete
10.40 pm ABC Start
10.45 pm ABC Complete
11.10 pm DEF Start
11.30 pm DEF Complete"| multikv forceheader=1
| eval t = -100 | accum t | eval _time = _time + t
| fields _time DateTime TestFeatureName Status
| rename comment as "Upto now is sample data only"
| sort _time
| transaction startswith=Status="Start" endswith=Status="Complete" | eval Occurrence=1 | accum Occurrence
| eval t=mvzip(DateTime,Status) | mvexpand t | eval DateTime=mvindex(split(t,","),0),Status=mvindex(split(t,","),1) | fields - t
| table DateTime TestFeatureName Status Occurrence
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.