Hi, I'm trying to create a report that does the same search for two different dates, the regular search uses a transaction:
(sourcetype="bi_log" "join room success") OR (source="analyticsreport" eventDescription concurrentUsers>0) | transaction eventId | stats dc(userId) as "Visitors" count(sessionId) as "Visits" dc(roomId) as "Total rooms" by eventDescription
For the current report I want to run it for today and 24h X DAYS AGO.
The finale report I will categorize by eventDescription as before but also by "day"
I tried several different times with no success, here is one of them:
(sourcetype="bi_log" "join room success" | append [search sourcetype="bi_log" "join room success" earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") OR (source="analyticsreport" eventDescription concurrentUsers>0 | append [search source="analyticsreport" eventDescription concurrentUsers>0 earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") | transaction eventId | stats dc(userId) as "Visitors" count(sessionId) as "Visits" dc(roomId) as "Total rooms" by eventDescription,new_t
I'll appreciate if any of you has suggestions, thanks!!
