Subquery Most Common API call by Account ID

Comments

1 comment

  • Avatar
    Shobhit Garg

    Hi Nikita,

    For this we need to have MAX for each AccountID and for that we either need to leverage the SUBQUERY or JOIN

    Below is one sample query I have written

    (_collector="HTTP")
    | parse "*,*" as A1,B1
    | count as C1 by A1,B1
    | where [subquery: _collector="HTTP"
    | parse "*,*" as A1,B1
    | count as C1 by A1,B1
    | max(c1) as C1 by B1
    | compose C1,B1]

    See the screenshots for more details.

    Regards

    0
    Comment actions Permalink

Please sign in to leave a comment.