Hi Team,
I need to use print two values from an index with different earliest values. please find the below example.
index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
]
My problem is I am using two earliest values so in my first earliest value I have a customer count of 57 and on the second earliest value customer count is 43, so while printing both the values it's printing the wrong value in one column.
Appendcols puts the results in order without correlating with the common column
To check this, you could alter your search like this
index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| eval MAU=Customer.":".MAU
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
| eval DAU=Customer.":".DAU
]
Yeah but this can be a way but, client isn't happy with it they need data like customer in one column and rest values each per column.
Can you give an example/mock up of what your customer would like it to look like?