Hi there
Trying to track down events that have a condition where they appear on days different to one another.
E.g. if I have 5 events that have field ID=foo that all appear on the same day (e.g. Monday) and another 5 that have ID=bar but are spread out over several days (e.g. Monday, Thursday, Saturday) I only want to return the ID=bar results.
Basically want to do this for any events with matching ID's that repeatedly occur on multiple different days.
What would be the best way to do this?
So I've tried this with " |fields ID _time" and it seems to be returning the ones I don't want (e.g. five events on the same day)
If you just want to group all events by the same ID in your timerange you can use
|stats values(*) as * by ID
If you need to group them in different days you can to do:
|bin span=1d _time
|stats values(*) as * by ID _time
Hey Johnson,
I would try something like this
index=<your_index> ID=*
|bin span=1d _time
|fields <all your fields> _time
|stats values(*) as * by ID