Display the next records in the top

Comments

1 comment

  • Avatar
    Shobhit Garg

    Hi Jellou,

    Probably you can achieve it with the help of subquery.

    What you can do here is write a subquery, might be same as that of main query and run the query for 1 week ago time-range and then you can compare the "program" of main query with that of sub-query

    https://help.sumologic.com/05Search/Subqueries

    Where operator syntax:

    Parent query
    | where [subquery [from=(<fromTime>)] [to=(<toTime>)] : <child query>
    | compose <field1>[, <field2>, ...] [maxresults=<int>]
    ]
    Rest of parent query

     

    Regards

     

    0
    Comment actions Permalink

Please sign in to leave a comment.