Hello Friends,
I'm trying to generate a table that summarizes the total count of events A, B and C as follows
search 1 | fields A
| stats count(A) as Net
| eval stage="A"
| append
[ search search 2 | fields B
| stats count(B) as Net
| eval stage="B"]
| append
[ search search 3 | fields C
| stats count(C) as Net
| eval stage="C"]
| table stage, Net
But I cannot seem to find a way to the create a field named "conv" that will compute the follow opeacion:
take the value of the current Net count subtract the previous value and then devide it by the previous value, in other words find the percentage of conversion between stages, BUT for thw first row it will be zero something like this:
Stage | Net | conv |
A | 100 | 0 |
B | 80 | (80- 100)/100 = -0.2 |
C | 70 | (70-80) /80 = -0.125 |
I was thinking about a way to calculate something with a for loop? but I dont know how ti access the indexes of the table... Thank you so much to everyone that can help me like THANK YOU SO MUCH
| streamstats values(Net) as previous window=1 current=f
| eval conv=(Net-previous)/previous
| streamstats values(Net) as previous window=1 current=f
| eval conv=(Net-previous)/previous
@ITWhisperer thank you for your great help! it means a lot to me, your code worked as expected 10/10 I will reading documenaton of streamstats and eventstats to use them in the futurethank you so much again, thanks a lot