Hello everyone,I have this query- index="dpsnapitt" AND (class= "GRADE 12 B" OR class= "GRADE 12 B *") AND (day="DAY 4" OR NOT day=*) | rename "start time" as start, "end time" as end | rename class as Class | rename email as organizer_email | dedup subject, Class, organizer_email, start | join type=outer organizer_email [search index="dpsn_teachers" earliest=0 latest= now | rename name.fullName as teacher | rename primaryEmail as organizer_email] |join type=outer organizer_email max=0 [search index="dpsn_meet" | where email== organizer_email] | rex field=date "(?<yy>[^\.]*)\-(?<mm>[^\.]*)\-(?<dd>[\S]*)T(?<hh>[^\.]*)\:(?<min>[^\.]*)\:(?<sec>[^\.]*)\." | eval ndatetime = yy.mm.dd.hh.min.sec | eval _time=strptime(ndatetime,"%Y%m%d%H%M%S") + 19800 | eval Time=strftime(_time, "%H:%M") | eval p = strptime(start,"%H:%M")-1020|eval q = strftime(p,"%H:%M") | eval r = strptime(end,"%H:%M") |eval s = strftime(r,"%H:%M") | eval meet_start_time = strftime((strptime(Time,"%H:%M")-duration_seconds), "%H:%M") | eval z = if((meet_start_time >= q AND meet_start_time <= s), 1, 0) | eval meeting_code = case( z == 1, meeting_code, z==0, "N/A") | dedup organizer_email, meeting_code, start, end | table Class, teacher, organizer_email, subject, "start", "end", meeting_code | sort - period - day | reverse If I run this query on 4 Dec 2020,it is producing following result-see image. Those rows where meeting code is present is getting duplicated with meeting_code "N/A".I dont want that duplicated row. Please help..I would be very thankful.
... View more