Need help with a situation.
Example table below:
column1,column2,column3,_time
1,2,3,21st
1,2,3,22nd
1,2,3,23rd
3,2,1,23rd
4,5,6,23rd
if on multiple days/times, column1 ,2 and 3 are same(4th column is _time ) , then add a new field(count) with incrementing numbers by _time , like below. how can this be done ? need help with query..
column1,column2,column3,_time,count
1,2,3,21st,1
1,2,3,22nd,2
1,2,3,23rd,3
3,2,1,23rd,1
4,5,6,23rd,1
| bin _time span=1d
| stats count by column1,column2,column3_time
| streamstats count by column1,column2,column3
Works perfectly fine, thank you...
| bin _time span=1d
| stats count by column1,column2,column3_time
| streamstats count by column1,column2,column3