The first query I calculate the daily amount, calculated after the date +7 days, the average amount of 5/9 to 5/16, the field name is Totalweekqty, Totalweekqty still calculate the number of the day. How do i make |search now < week| or | where now < month | working? Thank you.
sourcetype=xxx PartNo=123 VendorCode=1000 storage_in_date=2014-05-09*
| eval Indate = substr(storage_in_date, 1, len(storage_in_date)-13)
| eval now = strptime(Indate, "%Y-%m-%d")
| stats sum(qty) as Totaldayqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo
|search now < week
| stats values(Totaldayqty) as Totaldayqty avg(Totaldayqty) as Totalweekqty values(now) as now values(week) as week values(month) as month by VendorCode,PartNo
| where now < month | stats values(Totaldayqty) as Totaldayqty values(Totalweekqty) as Totalweekqty avg(Totalweekqty) as Totalmonthkqty by VendorCode,PartNo |
You need to scrap everything after the first pipe ("|"), show us a few events from your base search, and then clearly explain what you are trying to accomplish. Your search makes no sense and there is not enough explanation to allow us to understand what you are trying to do.