Merge multipel events

[ivanlesk]

Hi,
I have something like this.

    ID    date(month)  avgValue1  avgValue2   avgValue3   ...
    111   2016-06      value      value       value       ...
    111   2016-07      value      value       value       ...
    222   2016-01      value      value       value       ...
    222   2016-03      value      value       value       ...
    ...   ...          ...        ...         ...         ...

I basically have two event per ID (event for month before and event for month after)
I would like to join/merge that in one event that would look something like this:

ID   avgValue1_before   avgValue1_after   avgValue2_before   avgValue2_after ...
111  value              value             value              value           ...
222  value              value             value              value           ...

Is this somehow possible?

[cmerriman · Accepted solution]

...|sort 0 + ID + "date(month)"|streamstats count by ID "date(month)"|eval beforeAfter=if(count==1,"before","after")|chart values(avgValue1) as avgValue1 values(avgValue2) as avgValue2 by ID beforeAfter

try something like this.

[ivanlesk]

...|sort 0 + ID + "date(month)"|streamstats count by ID "date(month)"

should be without "date(month)" (if you count it by id and date count is allways =1)

But apart from that, it works. Thx

[cmerriman]

good call!