Hello Friends,
I have an interesting query that I would like help on.
I have three transactions that we are tracking and I would like to create a graph that has the three transaction time categor...
See more...
Hello Friends,
I have an interesting query that I would like help on.
I have three transactions that we are tracking and I would like to create a graph that has the three transaction time categories and their averages.
I am able to graph the three graphs together, and I can do their average individually, but I need help combining them together.
My code to show all of the different graphs are:
|multisearch [search ( index="a" addinventory InboundInventoryChangeElement ) | eval addTime = if(actionelementname=="AddInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where addTime>0 ] [search ( index="a" SWAPinventory InboundInventoryChangeElement ) | eval swapTime = if(actionelementname=="SwapInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where swapTime>0 ] [search ( index="a" removeinventory InboundInventoryChangeElement ) | eval removeTime = if(actionelementname=="RemoveInventory",strftime(strptime(length,"%H:%M:%S.%f"),"%S.%f") ,length) |where removeTime>0 ] |table _time, addTime, swapTime, removeTime
And here is my search for the averages.
index="a" addinventory InboundInventoryChangeElement | eval addTime = strftime(strptime( length,"%H:%M:%S.%f"),"%S.%f") |where addTime>0| table _time, addTime | join [ search index="a" addinventory InboundInventoryChangeElement | eval addTime = strftime(strptime( length,"%H:%M:%S.%f"),"%S.%f") |where addTime>0 |stats avg(addTime) as AverageAddTime]
The other two searches are the exact same except it the variables are different for the add, swap, and remove.
Any help would be greatly appreciated!
Also, if there is an easier way rather than joins and multisearches, please let me know!
Thank you!!!