count duplicates by timeslice

Follow

Alessandro Piccione

• April 03, 2019 10:00

This query works:
_sourceCategory=prod 
| parse "Id=*;" as marketId
| timeslice 1s
| count(marketId) as c, count_distinct(marketId) as d, count_distinct(marketId) by _timeslice

but I want a field calculated as: (c-d) as duplicates

I can't do the subtraction inline so I extracted the 2 fields and created the duplicates field.
| count(marketId) as c, count_distinct(marketId) as cd
| (c-cd) as duplicate

but now I'm not able to use timeslice.
I also tried transpose without success

 

0

• 

  Kevin Keech

  • April 03, 2019 17:49

  Does the following work? This should provide a value for duplicates for each timeslice. 

  _sourceCategory=prod 
  | parse "Id=*;" as marketId
  | timeslice 1s
  | count(marketId) as c, count_distinct(marketId) as d, count_distinct(marketId) by _timeslice
  | c-d as duplicates

  0

  Permalink
• 

  Alessandro Piccione

  • April 05, 2019 14:41
  • Edited

  Hi Kevin,

  that works! (also without the duplicated "count_distinct(marketId)")

  Thanks

  0

  Permalink

Please sign in to leave a comment.