I'm using a query to return the count of client requests by day in separate columns. I'd like to be able to add a column to the end that totals up the values for all of the days so that I can sort on that column. Any recommendations would be greatly appreciated!
_sourceCategory = prod/cf-logs/marketleader ClientCountry*
| json "ClientIP", "ClientRequestHost", "ClientRequestUserAgent", "ClientRequestURI", "OriginIP", "ClientIPClass", "RayID", "ClientRequestMethod" as client_ip, client_request_host, client_request_user_agent, client_request_uri, origin_ip, client_ip_class, ray_id, client_request_method nodrop
| timeslice 1d
| formatDate(_timeslice,"MM-dd-yyyy") as day
| count(client_request_user_agent) by day, client_request_user_agent
| transpose row client_request_user_agent column day
| limit 25
Please sign in to leave a comment.