Hi , i have the following fields (host id time) and 6 records
host | id
****** *****************
A | 3
A | 5
B | 1
B | 6
C | 5
C | 3
If the following conditions is met , the records will be product A and B respectively as below :
eval product A = (if host = A and id = 3) AND (if host = B and id = 6) AND (if host = C and id = 5) >> total 3 records
eval product B = (if host = A and id = 5) AND (if host = B and id = 1) AND (if host = C and id = 3)
My final outcome should be like this in stats :
product | count
****** *****************
A | 3 (3 events matches product A)
B | 3
I've tried>>" eval product = case(host=="A" AND id=='3', "A" , host=="B" AND id=='6', "A" ) etc | stats count(host) by product" but not working , it just keep loading . Am i doing it wrongly ? Please correct me if i'm wrong
Thanks
... View more