About MorphiusX

MorphiusX · ‎07-24-2022

Hi, Thanks for the help. With some troubleshooting, I was able to get it working. The one thing that messed me up was putting quotes around the source in the if statements. My final code is ID=* index=ind ((source=start) OR (source=accept) OR (source=reject) OR (source=received)) | eval time1=if(source="start", _time, null()) | eval time2=if(source="accept", _time, null()) | eval time3=if(source="reject", _time, null()) | eval time4=if(source="received", _time, null()) | stats values(time1) AS time1 values(time2) AS time2 values(time3) AS time3 values(time4) AS time4 by ID

MorphiusX · ‎07-21-2022

Beginner user here. PART 1 Wanting to track documents over multiple sources to ensure they reach their destination Source 1 - Source 2 or 3 - Source 4 Start Point (Sent) - Middle Points (Accepted or Rejected) - End Point (Received) Each document has the following ID = Unique to each document DATE \ TIME STAMP = Says what time the document arrived to that point DESCRIPTION = like a subject what the document contains All documents have a unique ID that is tracked on each source. I want to track this ID and ensure that it has gone from source 1 ,2 or 3 and arrived at 4. If for some reason its in 2 and not in 4 display that Doc ID in a table. PART 2 - I can probably work this one out myself after I know how to link everything. After they are linked I would like to compare the time between when it was at source 1 to when it arrived at source 3.

Posts	2
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎07-21-2022

Online Status	Offline
Date Last Visited	‎07-25-2022 11:49 PM

Document Flow tracking over multiple sources. Link...

Re: Document Flow tracking over multiple sources. ...

Document Flow tracking over multiple sources. Link...