uid,uname,in,out,seen
1,aa,8,,8
1,aa,8,,9
1,aa,8,10,9
2,bb,6,,7
3,cc,7,,8
1,aa,11,,11
1,aa,11,12,12
3,cc,9,9,9
--- expected output ---
1,aa,8,10,9
2,bb,6,,7
3,cc,7,9,9
1,aa,11,12,12
Basically, I want to group events on 'uname' and the 'in; time and update the last available time of the columns 'out', 'seen' in available group of events.
Try this:
... | stats last(in) AS IN last(out) AS OUT last(seen) AS SEEN BY uid,uname
Try this:
... | stats last(in) AS IN last(out) AS OUT last(seen) AS SEEN BY uid,uname