Timechart the daily sum of the last value of a field for each unique value of another field

[thefosk]

Hello,

I have events in the following format (ordered from oldest to newest😞

buyer=1 open_cases=3
buyer=1 open_cases=2
buyer=1 open_cases=5
buyer=2 open_cases=6
buyer=2 open_cases=1

Cases can be opened or closed during the day and "open_cases" can increase and decrease over time for a specific "buyer". I would like to visualize a timechart of the sum of every "open_cases" we have every day for each buyer.

So first we need to retrieve the last number of open_cases by buyer :

buyer=1 open_cases=5
buyer=2 open_cases=1

The sum them up:

sum_open_cases=6

and then create a timechart that shows the daily trend of "sum_open_cases". How can I achieve this?

[to4kawa · Accepted solution]

| makeresults
| eval _raw="buyer=1 open_cases=3
 buyer=1 open_cases=2
 buyer=1 open_cases=5
 buyer=2 open_cases=6
 buyer=2 open_cases=1"
| multikv noheader=t
| fields _raw
| rename COMMENT as "this is sample, from here, the logic"
| kv
| bin span=1d _time
| stats last(open_cases) as last_cases by buyer _time
| stats sum(last_cases) as sum_open_cases by _time

try after COMMENT