Hi, I needed do get the last "etapa" from some transactions indexed by "pedido", so I did a "streamstats count", prefix "etapa" with "count". This way I could bypass alphabetic ordination.
After it, I remove the prefix "1|", "2|", "3|" ... it using a temp variable named "etapa2" and regex.
This workaround solve it for me:
search...
| streamstats count
| eval count=substr("0000000".tostring(count), -5)
| eval etapa=count."|".etapa
| transaction pedido startswith="*status\=\"iniciado\"" mvlist=pedido
| rex field=etapa "^\d+\|(?<etapa2>.*)$"
| eval etapa=etapa2
| eval l_etapa = mvindex(etapa,0)
| ....
I hope this can help you.
Edited: I add this line to fix errors on alphabetic ordination. Ex: "10 < 2". Now we got "10 > 02"
| eval count=substr("0000000".tostring(count), -5)
... View more