Display the next records in the top

Follow

Jellou Mae Infante

• January 28, 2021 01:43

Hi,

For example i have this on my dashboard

Top 10 programs

1) a

2) b

3) c

4) d

5) e

6) f

7) g

8) h

9) i

10) j

I would like to know if it is possible that if the numbers 1-3 occurred last week they will be removed, #4 will now be the top 1 and 11-13 will be included in the top 10 list?

0

• 

  Shobhit Garg

  • February 05, 2021 11:49

  Hi Jellou,

  Probably you can achieve it with the help of subquery.

  What you can do here is write a subquery, might be same as that of main query and run the query for 1 week ago time-range and then you can compare the "program" of main query with that of sub-query

  https://help.sumologic.com/05Search/Subqueries

  Where operator syntax:

  Parent query
| where [subquery [from=(<fromTime>)] [to=(<toTime>)] : <child query>
| compose <field1>[, <field2>, ...] [maxresults=<int>]
]
Rest of parent query

   

  Regards

   

  0

  Comment actions Permalink

Please sign in to leave a comment.