Hi,
I've got a table like this
ts1 | ts2 | count | id
1461347440 | 1461347448 | 5 | 1234
1461347459 | 1461347452 | 10 | 1234
1461347455 | 1461347459 | 10 | 7899
I would like to sum "count" if ts1<=ts2
, for each id. My approach looks like this, but it seems to fail because of the field comparison
| eventstats sum(eval(if(ts1<ts2, count, null()))) AS sum BY Id
Can you help me to get the wanted calculation?
Thanks in advance
Heinz
Whenever you try to add null
, you will trash your field so use 0
instead:
| eventstats sum(eval(if(ts1<ts2, count, 0))) AS sum BY Id
Whenever you try to add null
, you will trash your field so use 0
instead:
| eventstats sum(eval(if(ts1<ts2, count, 0))) AS sum BY Id