How to sort by timeslice with 3 parse extracted field

Follow

Jellou Mae Infante

• October 27, 2020 08:46

0

• 

  Harinder Bhandari

  • October 27, 2020 17:50

  Hi Jellou,

  You can sort by timeslice, field 1, field2, field3 like this:

  | timeslice 1h
  | parse field1
  | parse field2
  | parse field3
  | count by _timeslice, field1, field2, field3
  | sort by _timeslice

  
  Hope this helps.

  Thanks.

   

  0

  Comment actions Permalink
• 

  Jellou Mae Infante

  • October 28, 2020 08:30

  Hi,

  I was able to do that. However, im getting some error upon implementation of outlier with that.

  0

  Comment actions Permalink

Please sign in to leave a comment.