is there a way where I can tag events and add another field based on hierarchy?
For example:
Id 1 has different initial tags (A,B,C, and D) since A is the highest, the final tag should be "A"
ID | InitialTag | FinalTag
1 A A
1 B A
1 C A
1 D A
Tag Ranks:
A - 1st
B - 2nd
C -3rd
D - 4th
Hi patricianaguit,
if InitialTag is a number you can use in the stats command the function max, e.g.
my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID
Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:
Tag,Rank
A,1
B,2
C,3
D,4
and a search like this:
my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID
Bye.
Giuseppe
Hi patricianaguit,
if InitialTag is a number you can use in the stats command the function max, e.g.
my_search
| stats values(InizialTag) AS InitialTag max(InitialTag) AS FinalTag BY ID
Otherwise, if InitialTag has a limited number of values, you can use a lookup to give a rank to your values, e.g.:
a lookup with two values called TagRank.csv:
Tag,Rank
A,1
B,2
C,3
D,4
and a search like this:
my_search
| lookup TagRank.csv Tag AS InitialTag OUTPUT Rank
| stats values(InizialTag) AS InitialTag max(Rank) AS FinalTag BY ID
Bye.
Giuseppe
thank you this worked for me!
what's your logic to say A is the highest? (alphabetical order?)
Try this:
|eventstats first(InitialTag) as FinalTag by ID