Greetings...
I have a table that looks like:
Timestamp | Action | User
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Fail| User2
Is there a way to break this down into separate tables by User such that:
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Fail| User2
That's right, because it wasn't in the request.
index=_internal | head 1 | fields _raw | eval _raw="Timestamp | Action | User
YYYY-MM-DD HH:MM:SS | Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed | User2
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Fail | User2"
| rename COMMENT as "these are your log sample. from here, the logic"
| rex mode=sed "s/( \| )/,/g"
| multikv forceheader=1
| table Timestamp Action User
| sort User
| autoregress User
| streamstats count as tmp
| eval User=mvdedup(mvappend(User,User_p1))
| fields - User_p1
| mvexpand User
| streamstats count by tmp
| sort User
| foreach * [ eval <<FIELD>>=if(count=2,NULL,'<<FIELD>>')]
| table Timestamp Action User
It's not easy to open a line.
This gets me pretty close.
I guess there is no trellis for a stats table.