Summarizing Total by Columns
I'm using a query to return the count of client requests by day in separate columns. I'd like to be able to add a column to the end that totals up the values for all of the days so that I can sort on that column. Any recommendations would be greatly appreciated!
_sourceCategory = prod/cf-logs/marketleader ClientCountry*
| json "ClientIP", "ClientRequestHost", "ClientRequestUserAgent", "ClientRequestURI", "OriginIP", "ClientIPClass", "RayID", "ClientRequestMethod" as client_ip, client_request_host, client_request_user_agent, client_request_uri, origin_ip, client_ip_class, ray_id, client_request_method nodrop
| timeslice 1d
| formatDate(_timeslice,"MM-dd-yyyy") as day
| count(client_request_user_agent) by day, client_request_user_agent
| transpose row client_request_user_agent column day
| limit 25
-
Hi Chris,
I do not think you can achieve this. With transpose I am afraid we can achieve it.
You can alternatively try below. We can use accum. Please read more about accum here
| timeslice 1d
| formatDate(_timeslice,"MM-dd-yyyy") as day
| _raw as client_request_user_agent
| count(client_request_user_agent) as cc by day, client_request_user_agent
| accum cc as running_total by client_request_user_agent
Please sign in to leave a comment.
Comments
1 comment