I am trying to get the data into a chart from an index were a user may answer a question daily. This is what I need to produce: email sun mon tue wed thu fri sat bob@email.com - NO ...
See more...
I am trying to get the data into a chart from an index were a user may answer a question daily. This is what I need to produce: email sun mon tue wed thu fri sat bob@email.com - NO NO NO Yes - - aaron@email.com Yes - - NO - - - chuck@email.com NO NO NO Yes NO - Yes This i s what I am currently getting: email sun mon tue wed thu fri sat bob@email.com - - - - Yes - - bob@email.com - - - NO - - - bob@email.com - - NO - - - - bob@email.com - NO - - - - - aaron@email.com - - - NO - - - aaron@email.com - - - NO - - - aaron@email.com Yes - - - - - - chuck@email.com - - NO - - - - chuck@email.com - - - - NO - - chuck@email.com - - - Yes - - - chuck@email.com NO - - - - - - chuck@email.com - NO - - - - - chuck@email.com - - - - - - Yes Here is what I have so far, but I am stuck and not to sure what process I should use: index=someindex | eval qualdayOfWeek=strftime(_time, "%a") | rex field=_raw "is\s(?<status>(NO|YES))\sto" | eval sun=if(qualdayOfWeek="Sun", $status$, "-") | eval mon=if(qualdayOfWeek="Mon", $status$, "-") | eval tue=if(qualdayOfWeek="Tue", $status$, "-") | eval wed=if(qualdayOfWeek="Wed", $status$, "-") | eval thu=if(qualdayOfWeek="Thu", $status$, "-") | eval fri=if(qualdayOfWeek="Fri", $status$, "-") | eval sat=if(qualdayOfWeek="Sat", $status$, "-") | table email, sun, mon, tue, wed, thu, fri, sat