Hi all. I'm having trouble expanding a multivalued Transaction into separate fields by their corresponding values. I'm conducting a quality study to determine the number of incomplete first inspections. For example, inspector "a" initially approved a product, but when the product was returned for further service inspector "b" discovered issues that should've been captured originally. I've tried using the stats command to accomplish this, but the results were unreliable from a sequence of events perspective, so I've decided to use the transaction command which has yielded much better results.
What I would like to do is to keep the transaction grouped by productId, but separate eventTypes values by inspectorName, so I can create reporting.
This is queuery I'm trying to expand:
| transaction productId startswith=(eventType=approve AND new=true OR new=false) endswith=(eventType=reject AND new=true) mvlist=true
I've tried combining fields with mvzip, but it's hard for me to manipulate the data to create a nice tabular report.
