Hello teachers, I have encountered an SPL statement that involves restrictions on the map function. Currently, there is a problem of inaccurate data loss in the statistical results. Could you please ...
See more...
Hello teachers, I have encountered an SPL statement that involves restrictions on the map function. Currently, there is a problem of inaccurate data loss in the statistical results. Could you please advise on any functions in SPL that can replace map to achieve this? SPL is as follows: index=edwapp sourcetype=ygttest is_cont_sens_acct="是"
| stats earliest(_time) as earliest_time latest(_time) as latest_time
| addinfo
| table info_min_time info_max_time earliest_time latest_time
| eval earliest_time=strftime(earliest_time,"%F 00:00:00")
| eval earliest_time=strptime(earliest_time,"%F %T")
| eval earliest_time=round(earliest_time)
| eval searchEarliestTime2=if(info_min_time == "0.000", earliest_time, info_min_time)
| eval searchLatestTime2=if(info_max_time="+Infinity", relative_time(latest_time,"+1d"), info_max_time)
| eval start=mvrange(searchEarliestTime2,searchLatestTime2, "1d")
| mvexpand start
| eval end=relative_time(start,"+7d")
| where end <=searchLatestTime2
| eval end=round(end)
| eval a=strftime(start, "%F")
| eval b=strftime(end, "%F")
| fields start a end b
| eval a=strftime(start, "%F")
| eval b=strftime(end, "%F")
| map search="search earliest=\"$start$\" latest=\"$end$\" index=edwapp sourcetype=ygttest is_cont_sens_acct="是"
| dedup day oprt_user_name blng_dept_name oprt_user_acct
| stats count as "fwcishu" by day oprt_user_name blng_dept_name oprt_user_acct
| eval a=$a$ | eval b=$b$
| stats count as "day_count",values(day) as "qdate",max(day) as "alert_date" by a b oprt_user_name,oprt_user_acct
" maxsearches=500000
| where day_count > 2
| eval alert_date=strptime(alert_date,"%F")
| eval alert_date=relative_time(alert_date,"+1d")
| eval alert_date=strftime(alert_date, "%F")
| table a b oprt_user_name oprt_user_acct day_count qdate alert_date I want to implement statistical analysis of data from 2019 to the present, where a user visits multiple times a day and counts it as one visit, to calculate the continuous number of visits by interval users every 7 days since 2019.