I WANT TO COMBINE THOSE TIMESTAMP INTO ONE COLUMN HOW CAN I DO THAT
BUT I DON'T WANT USE THE TRANSACTION COMMAND
HELP ME GUYS THE SAMPLE TABLE
ID TIMESTAMP1 TIMESTAMP2
1 --------- ------ 201
1 210 ------------------
2 --------------- 310
2 310 ---------------
I WANT TO COMBINE BOTH OF THEM BUT DON'T USE TRANSACTION COMMAND.
Give this a try
your base search | stats values(TIMESTAMP1) as TIMESTAMP1 values(TIMESTAMP2) as TIMESTAMP2 by ID
Give this a try
your base search | stats values(TIMESTAMP1) as TIMESTAMP1 values(TIMESTAMP2) as TIMESTAMP2 by ID
it's worked perfectly thank you so much somesh...
No need to shout!
try this:
... | eval timestamp = coalesce(timestamp1, timestamp2)
you didn't specify what result you wanted, and this combines the two fields into one field as you requested.
somesh's answer you accepted combines two rows into one row. be more specific in your question.
actually single id am getting 1 column empty and other column have the value
in the same way id no 1 has another row that is also the same
so i want to dis play like this
1 210 201
2 310 310
3 410 450
like this ....
NO AM NOT GETTING THE RESULT WAS SAME IN FACT AM LOSING THE ONE COLUMN