Totals, or counting by multiple combinations of fields
_index=my_index
| parse "category: * " as category
| parse "customer: * " as customer
| timeslice 1d
| formatDate(_timeslice, "yyyy-MM-dd") as day
| count by customer, category, day
| transpose row customer, day column category
This gives me a table with a row for each combination of customer and day, and a column for each category with the count of matching log entries for that category on that day for that customer.
I'd like to add another column showing the total number of log entries for that customer on that day, irrespective of category.
Basically, this would be a "count by customer, day." However, I have not been able to figure out how to do two separate counts by separate combinations of fields and combine the results. Is it possible to do this?
Please sign in to leave a comment.
Comments
0 comments