I have events which contain batches. There are several batchtypes. For example Batch; A01,A02,A03.
When a batch is started it is stored for example like this: A01-sample-2019-03-20-mm. I want to count the number of batches per batchtype per moment (2019-03-20)
Now I have this: ....search...... | stats distinct_count(batch) as count by batch| table batch count
Hi
Give a try
| makeresults
| eval msg="A01-sample-2019-03-20-mm,A01-sample-2019-03-20-mm,A01-sample-2019-03-21-mm"
| makemv delim="," msg
| mvexpand msg
| rex field=msg "(?P<batch>^[^-]+)(\-\w+\-)(?P<date>\d{4}-\d{2}-\d{2})"
| stats count by batch,date
Hi
Give a try
| makeresults
| eval msg="A01-sample-2019-03-20-mm,A01-sample-2019-03-20-mm,A01-sample-2019-03-21-mm"
| makemv delim="," msg
| mvexpand msg
| rex field=msg "(?P<batch>^[^-]+)(\-\w+\-)(?P<date>\d{4}-\d{2}-\d{2})"
| stats count by batch,date