How to extract data

[1014502]

I want to know how to take data from multiple data sources by ID.
The following is an example of a data source.
A Datasource(A-id,B-id or C-id,B-Manhour or C-Manhour)
B Datasource(B-id,B-subject)
C Datasource(C-id,B-id,C-subject)
※A datasource is Man-hour information、B Datasource is Parent ticket information、C-datasource is Child ticket information

I want the output below.
id subject man-hour
B-id B-subject Total value of B-Manhour
B-id B-subject Total value of B-Manhour+Total value of C-Manhour
B-id B-subject Total value of C-Manhour

Please tell me how to do it.

[to4kawa · Accepted solution]

index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

[gcusello]

Hi @1014502,
your requisites aren't so clear, correct me if I'm wrong:

• in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);
• you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
• you want three rows for each B-id,
• relation between B-id and C-id is in C Datasource.

Is it correct?

Ciao.
Giuseppe

[1014502]

Hi@gcusello
.in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);

Example for A Datasource bellow.
( A-id,B-id,B-Manhour
A-id,C-id,C-Manhour )
A Datasource is the man-hour information of B ticket or C ticket.
・you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
Yes.
・you want three rows for each B-id,
Yes.
relation between B-id and C-id is in C Datasource.
Yes.

　

[gcusello]

Hi @1014502,
if it's acceptable for you to have results in three columns, you could run something like this:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id
| eval BC=B-Manhour+C-Manhour

I cannot test it, check in this way or adding C-id in BY clause of the stats command:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id C-id
| eval BC=B-Manhour+C-Manhour

Ciao.
Giuseppe