Hi @pedropiin Im not 100% sure if I'm on the right page...but nevertheless have a look to see if this helps you Ive used some sample data inline to help build out a working query for you to wor...
See more...
Hi @pedropiin Im not 100% sure if I'm on the right page...but nevertheless have a look to see if this helps you Ive used some sample data inline to help build out a working query for you to work with. | makeresults
| eval _raw = "[{\"name\":\"SampleMetric\",\"metric\":\"42\",\"xfield\":\"Mickey Mouse\"},{\"name\":\"SampleMetric\",\"metric\":\"17\",\"xfield\":\"Donald Duck\"},{\"name\":\"SampleMetric\",\"metric\":\"36\",\"xfield\":\"Goofy\"},{\"name\":\"SampleMetric\",\"metric\":\"29\",\"xfield\":\"Minnie Mouse\"},{\"name\":\"SampleMetric\",\"metric\":\"48\",\"xfield\":\"Pluto\"}]"
| eval events=json_array_to_mv(_raw)
| mvexpand events
| eval _raw=events
| fields _raw
| spath
| table name metric xfield
``` Sample data Prep work complete ```
| sort metric
| streamstats count as row_num
| eval xfield=IF(row_num==1,xfield,NULL())
| filldown xfield
| where row_num > 1
| stats values(xfield) as xfield,
avg(metric) as metric1,
max(metric) as metric2,
count(metric) as metric3
| fields xfield metric1, metric2, metric3 Please let me know how you get on and consider accepting this answer or adding karma this answer if it has helped. Regards Will