Hello,
I have events in the following format (ordered from oldest to newest😞
buyer=1 open_cases=3
buyer=1 open_cases=2
buyer=1 open_cases=5
buyer=2 open_cases=6
buyer=2 open_cases=1
Cases can be opened or closed during the day and "open_cases" can increase and decrease over time for a specific "buyer". I would like to visualize a timechart of the sum of every "open_cases" we have every day for each buyer.
So first we need to retrieve the last number of open_cases by buyer :
buyer=1 open_cases=5
buyer=2 open_cases=1
The sum them up:
sum_open_cases=6
and then create a timechart that shows the daily trend of "sum_open_cases". How can I achieve this?
| makeresults
| eval _raw="buyer=1 open_cases=3
buyer=1 open_cases=2
buyer=1 open_cases=5
buyer=2 open_cases=6
buyer=2 open_cases=1"
| multikv noheader=t
| fields _raw
| rename COMMENT as "this is sample, from here, the logic"
| kv
| bin span=1d _time
| stats last(open_cases) as last_cases by buyer _time
| stats sum(last_cases) as sum_open_cases by _time
try after COMMENT
| makeresults
| eval _raw="buyer=1 open_cases=3
buyer=1 open_cases=2
buyer=1 open_cases=5
buyer=2 open_cases=6
buyer=2 open_cases=1"
| multikv noheader=t
| fields _raw
| rename COMMENT as "this is sample, from here, the logic"
| kv
| bin span=1d _time
| stats last(open_cases) as last_cases by buyer _time
| stats sum(last_cases) as sum_open_cases by _time
try after COMMENT