count duplicates by timeslice

Comments

2 comments

  • Avatar
    Kevin Keech

    Does the following work? This should provide a value for duplicates for each timeslice. 

    _sourceCategory=prod 
    | parse "Id=*;" as marketId
    | timeslice 1s
    | count(marketId) as c, count_distinct(marketId) as d, count_distinct(marketId) by _timeslice
    | c-d as duplicates
    0
    Comment actions Permalink
  • Avatar
    Alessandro Piccione

    Hi Kevin,

    that works! (also without the duplicated "count_distinct(marketId)")

    Thanks

    0
    Comment actions Permalink

Please sign in to leave a comment.