The following query just gives me results but I also need to count by each Group.
index=Container_ship action=Decision result=*
| spath "Groups{}"
| search "Groups{}"=Sedan* OR "Groups{}"=SUV*
| dedup invoice
| timechart span=1mon count by result
Results show Yes or No but I also need to count by the Groups which has more than Sedan or SUV listed like color but I also only want to count whatever name appears first in the group entry.
Thanks!
To split by more than one field over _time, use bin and stats instead of timechart:
| timechart span=1mon count by result
=>
| bin _time span=1m
| stats count by _time result "Groups{}"
This will generate results with _time, result, Groups{}, and count fields.