Use _count as column (subquery)

Follow

Shraddha Mantri

• August 22, 2019 21:37

I have a query like following:

_sourceName = abc
| parse "MsgId = *" as msgId
| timeslice 1h
| count by msgId, _timeslice
| transpose row _timeslice column msgId

I know the count for each msg id will be either 1,2 or 3. I want to write this query in a way that I get the count of msgId per hour that appeared for 1,2, or 3 times. Row should be timeslice and column should be 1,2,3. This is may be possible with a subquery.

can any one please help?

 

0

• 

  Kevin Keech

  • August 27, 2019 19:58

  The following query should help give you what you are looking for and does not require a subquery operation. 
  
  

  _sourceName = abc 
  | parse "msgid= *" as msgId
  | timeslice 1h 
  | count by msgId, _timeslice 
  | _count as cnt
  | count by _timeslice, cnt
  | transpose row _timeslice column cnt

  0

  Comment actions Permalink
• 

  Shraddha Mantri

  • August 27, 2019 21:30

  It worked. Thank you!

  0

  Comment actions Permalink

Please sign in to leave a comment.