Thank you, your answer was so usefull !
Now we want to have result by serial. So we have now 3 different values, and we would like to execute the foreach for each value.
Here the code' example
index="Test"
| append [search (type="1")
| stats distinct_count(ID) as r by Serial
| eval ID1=(100.00-r)]
| append [search (type="2")
| stats distinct_count(ID) as r by Serial
| eval ID2=(100.00-r)]
| append [search (type="3")
| stats distinct_count(ID) as r by Serial
| eval ID3=(100.00-r)]
|eval Min_all=101,Min_Comp=0
| eventstats values(ID1) as Min_Var1 , values(ID2) as Min_Var2, values(ID3) as Min_Var3
|foreach Min_Var* [|eval Min_Comp=('<>')
| eval Min_all=if(
Min_Comp<Min_all,
Min_Comp,
Min_all) ]
| stats first(ID1),first(ID2),first(ID3), first(Min_all), first(Min_Comp) by Serial
example of our result
ID1 ID2 ID3 Min_all Min_comp
95 90 96 101 100
96 91 92 101 100
98 95 97 101 100
Min_all and Min_comp aren't right so we would like execute the foreach by line do you know how could we do it ?
... View more