I have email exchange transactional data with below fields. Looking some data with span of 1day. Like how many emails sent by users having attachment vs no attachment.
message_id, email_id, attachment_count, recipient_name
abc, nameA, 0, xyz
Expected result is :date(like dd/mm/yy), email_ID, HasAttachmnetcount, NoAttachmnet count.
1/1/2022,nameA, 4, 3
I am able to write chart (over email_id by isattachmnet) and get data for the selected duration, but unable to list data splited day wise.
please try something like this:
| bin span=1d _time
count(eval(attachment_count=0)) AS NoAttachmnet
count(eval(attachment_count>0)) AS HasAttachmnetcount
BY _time email_id
| eval date=strftime(_time,"%d/%m/%Y")
| table date email_id HasAttachmnetcount NoAttachmnet