I would like to get a stats per week of a Customer that would be result like the Table 1.
The data I'm playing with is 100+ Customer and randomly values.
Table 1.
| Week | CustomerA | CustomerB | CustomerC | CustomerD | CustomerE |
| 27 | 60 | 0 | 0 | 37 | 22 |
| 28 | 110 | 0 | 0 | 35 | 21 |
| 29 | 65 | 0 | 0 | 56 | 20 |
| 30 | 33 | 0 | 0 | 72 | 13 |
| 31 | 4 | 0 | 0 | 2 | 3 |
Sample Raw log data:
| Date | Customer | Penalty |
| 11-Dec | CustomerA | Code32 |
| 2-Nov | CustomerB | Code32 |
| 3-Oct | CustomerA | Code31 |
| 5-Dec | CustomerA | Code01 |
| 5-Nov | CustomerA | Code22 |
| 5-Nov | CustomerC | Code11 |
| 9-Nov | CustomerB | Code31 |
I used the Span command to compile it as per Week and did the stats command below however this result not showing the way I need it.
|stats count by Customer by Week
My goal is to count the penalty of each customer per week and do some stack bar graph.
Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?
Please check if this helps .
Thanks a lot. The result is what I need.
Below may help
| timechart span=1w count by Customer | eval week=strftime(_time, "%U")
The command below are not working. It shows invalid argument.
| timechart span=1w count by Customer