index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26 MachineState="*" | stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval "Login Hours"=ElapsedMachineSecondsInOrderPath/3600 | chart sum("Login Hours") **over** MachineState by EmployeeLoggedInLastName
updated - marked as code
Ah. You lost the values for MachineState
in your stats
command. Any field not present in the stats
command is GONE after it.
I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")
index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26 MachineState="*"
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState
| eval "Login Hours"=round(ElapsedSeconds/3600,2)
| chart sum("Login Hours") over EmployeeLoggedInLastName by MachineState
Ah. You lost the values for MachineState
in your stats
command. Any field not present in the stats
command is GONE after it.
I'm assuming you have many more employees then you have machine states, so you may want to remember "over rowname by columnname")
index="Plt15_tms3" ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber<26 MachineState="*"
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedSeconds by EmployeeLoggedInLastName MachineState
| eval "Login Hours"=round(ElapsedSeconds/3600,2)
| chart sum("Login Hours") over EmployeeLoggedInLastName by MachineState
Thank you for this solution and lesson. I didn't know it would be lost after stats.
@hppjet - yes, stats
is a transforming command that summarizes all the records into a few new summary records. If you want to do something stats
-like, but just want to add the calculated fields to every event, then use eventstats
. If you want to do something that will process the events in order, like calculating an ongoing cumulative value across time, then use streamstats
or accum
. They each have their place.
I was hoping to create a column chart that has totals for "Login Hours" that is separated by machine state(running, stopped) that is broken out by Employee last name.
@hppjet - can you post a quick mockup of your desired output?
hmm what is your desired output? can you be a bit more specific?