Are there in group by operators for String fields

Follow

Shanmukhanand Naikwade

• January 27, 2021 21:10

In Sumo, can we have group by operator for string fields. 

For example, here is the sample table. 

Fruit	Market_name	price
apple	m1	2
apple	m2	3
apple	m3	1
orange	m2	3
orange	m3	1

The output of the query should be 

fruit	market_name	avg price
apple	m1 m2 m3	2
orange	m2 m3	2

 

 

In short, market_name field is aggregated as well to capture all unique values in there.

0

• Official comment

  

  Jorge Silva

  • January 27, 2021 22:05

  To group by market_name as well as fruit, the "avg" operator line would be like this:

  | avg(price) as "avg_price" by fruit, market_name

  Give this a try and let me know if any questions.

  Comment actions Permalink
• 

  Shanmukhanand Naikwade

  • January 27, 2021 21:19

  rownum	fruit	market_name	avg price
  1	apple	m1 m2 m3	2
  2	orange	m2 m3	2

  0

  Comment actions Permalink
• 

  Shanmukhanand Naikwade

  • January 27, 2021 21:27

  So the query would be something like 
  
  | avg(price) as "avg_price" by fruit. 
  
  But is there a way i can get market_name in the query result as well?
  
  

  In splunk, the query would look like 
  | stats avg(price), values(market_name) as market_name by fruit

  0

  Comment actions Permalink
• 

  Shanmukhanand Naikwade

  • January 27, 2021 22:09

  Hi Jorge,

  No, it does not meet the requirements. I do not want market_name in my group by fields. 

   

  If i use the query you provided, it will give me the result like - 

  Fruit	Market_name	price
  apple	m1	2
  apple	m2	3
  apple	m3	1
  orange	m2	3
  orange	m3	1

  Which is average price per fruit and market_name. I do not want this. 

   

  I want average price per fruit only but i also want to see all unique values for market_name in the final result

  0

  Comment actions Permalink
• 

  Jorge Silva

  • January 27, 2021 22:42

  Let's move this conversation to the ticket you open with support.

  0

  Comment actions Permalink
• 

  Shanmukhanand Naikwade

  • January 28, 2021 21:37

  There is an idea posted on sumo. 

  • SLP-I-3601 - https://ideas.sumologic.com/ideas/SLP-I-3601

  I would encourage all of you who visit this post to vote the idea. 

  0

  Comment actions Permalink

Please sign in to leave a comment.