Hello Everyone,
I have a requirement where I have to generate a query.
event 1 : <l:event dateTime="2023-02-10 11:28:49.299"......some ******data*****<ns2:orderNumber>111040481</ns2:orderNumber>*****some****data****<ns2:customerType>B2C</ns2:customerType>
event 2 : event dateTime="2023-02-15 11:28:49.299"......some ******data*****<ns2:orderNumber>111040481</ns2:orderNumber>*****some****data****
I have to fetch OrderNumber from event2, and CustomerType from event1... As ordernumber is unique.. Since event1 and event2 are on different date, can we write a query to get a report ?
Assuming the fields are extracted already, use the stats command to group events by orderNumber.
| stats values(*) as * by orderNumber
Hi.. Thank you for responding..
But my query is how will i keep the time range.. because event 2 can come on any date.. how to generate report out of it.. My report should look like
Order Number | Customer Type | Date |
The stats command I gave groups events by orderNumber and preserves the other fields. After that you can use other SPL reporting commands to get the output you want.