Hi Team, I need to use print two values from an index with different earliest values. please find the below example. index=abcd cust_name="*" earliest=-30d@d | fields cust_name,origUserid,destUs...
See more...
Hi Team, I need to use print two values from an index with different earliest values. please find the below example. index=abcd cust_name="*" earliest=-30d@d | fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID | eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID) | rename cust_name as Customer | dedup id | stats count(id) as MAU by Customer | appendcols [ search index=abcd cust_name="*" earliest=-14d | fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID | eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID) | rename cust_name as Customer | dedup id | stats count(id) as DAU by Customer | eval DAU=round(DAU/14,2) ] My problem is I am using two earliest values so in my first earliest value I have a customer count of 57 and on the second earliest value customer count is 43, so while printing both the values it's printing the wrong value in one column.