I would like to get a stats per week of a Customer that would be result like the Table 1.
The data I'm playing with is 100+ Customer and randomly values.
Table 1.
Week | CustomerA | CustomerB | CustomerC | CustomerD | CustomerE |
27 | 60 | 0 | 0 | 37 | 22 |
28 | 110 | 0 | 0 | 35 | 21 |
29 | 65 | 0 | 0 | 56 | 20 |
30 | 33 | 0 | 0 | 72 | 13 |
31 | 4 | 0 | 0 | 2 | 3 |
Sample Raw log data:
Date | Customer | Penalty |
11-Dec | CustomerA | Code32 |
2-Nov | CustomerB | Code32 |
3-Oct | CustomerA | Code31 |
5-Dec | CustomerA | Code01 |
5-Nov | CustomerA | Code22 |
5-Nov | CustomerC | Code11 |
9-Nov | CustomerB | Code31 |
I used the Span command to compile it as per Week and did the stats command below however this result not showing the way I need it.
|stats count by Customer by Week
My goal is to count the penalty of each customer per week and do some stack bar graph.
Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?
Please check if this helps .
Thanks a lot. The result is what I need.
Below may help
| timechart span=1w count by Customer | eval week=strftime(_time, "%U")
The command below are not working. It shows invalid argument.
| timechart span=1w count by Customer