.... |eval select= substr(month,0,7) |stats sum('estimate_hours') as prep by select |eval 【{select}予定時間】＝prep ... View more

ありがとうございます。無事に解決しました ... View more

ここにソースコードと検索ステートメントを貼り付けられますか？ ... View more

index=A OR index=B | eval parent.id = coalesce(id, 'parent.id', 'issue.id') | eval issue.id = nullif('issue.id','parent.id') | stats values(id) as id values(issue.id) as issue.id values(type) as type values(subject) as subject values(man-hour) as man-hour by parent.id | fields - parent.id | selfjoin issue.id | table id,type,subject,man-hour こんにちは 動かしてないので間違いがあるかもしれませんが、こちらでどうでしょう？ | makeresults | eval _raw="id,issue.id,parent.id,type,subject,man-hour a,c,,,,2 ,b,,111,, ,c,b,,test," | multikv forceheader=1 | rename issue_id as issue.id parent_id as parent.id, man_hour as man-hour | table id,issue.id,parent.id,type,subject,man-hour | eval parent.id = coalesce(id, 'parent.id', 'issue.id') | eval issue.id = nullif('issue.id','parent.id') | stats values(id) as id values(issue.id) as issue.id values(type) as type values(subject) as subject values(man-hour) as man-hour by parent.id | fields - parent.id | selfjoin issue.id | table id,type,subject,man-hour 確認しました。フィールドをシングルコーテーションで囲わないとうまくいかなかったですね。 修正しています。 ... View more

Hi @1014502, if it's acceptable for you to have results in three columns, you could run something like this: index=A Or index=B OR index=C | stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id | eval BC=B-Manhour+C-Manhour I cannot test it, check in this way or adding C-id in BY clause of the stats command: index=A Or index=B OR index=C | stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id C-id | eval BC=B-Manhour+C-Manhour Ciao. Giuseppe ... View more