I am trying to get count of four fields [ company_name companyID CustomerId Provider] by each hour
index=IndexName
| bin span=1h _time
| stats count by company_name companyID CustomerId Provider _time
| sort 0 _time
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider'
| eval time=strftime(_time,"%m-%d-%Y--%H-%M-%S")
| table results time count
| xyseries results time count
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)"
| table company_name companyID CustomerId Provider *
| addcoltotals labelfield=company_name label="Total_count"
| fields - count results
I am able to get results like i need, But i am pretty sure this search isn't the good way to do it.
Expected results:
company_name companyID CustomerId Provider 12:00 01:00 02:00 03:00 04:00 ---
Apple 1234 vgs31982 pro-1 10 20 30 40 10
google 567 kjf733 pro-2 11 11 33 83 20
Total_count 21 31 63 123 30
can some help me on this.
index=IndexName
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider'
| timechart span=1h count by results
| eval time=strftime(_time,"%H:%M")
| table results time count
| xyseries results time count
| addcoltotals labelfield=results label="Total_count"
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)"
| table company_name companyID CustomerId Provider *
| fields - count results
| fillnull company_name value="Total_count"
Actually my query is working fine, I am just looking for a different approach without combining all fields.
I can't accept this answer, I don't see any difference from what my question is..
If that is the case, you will need to show us a sample log.