About _Mauro_Costa_

_Mauro_Costa_ · ‎08-10-2021

@venkatasri thanks this worked for me " | eventstats max(order_id) as order_id by id "

_Mauro_Costa_ · ‎08-09-2021

Hello I have a query that gives me the data below: _time | id | order_id | job | user_id ------------------------------------------------------------------------------------ 2021-06-08 17:00:00 | 2240905 | - | done | 23 ------------------------------------------------------------------------------------ 2021-06-08 17:00:00 | 2240844 | - | done | 23 ------------------------------------------------------------------------------------ 2021-06-08 12:00:00 | 2240905 | - | start | 167 ------------------------------------------------------------------------------------ 2021-06-15 10:00:00 | 2240844 | - | start | 102 ------------------------------------------------------------------------------------ 2021-06-15 10:00:00 | 2240905 | 1066899 | allocated | 23 ------------------------------------------------------------------------------------ 2021-06-15 09:00:00 | 2240844 | 1055788 | allocated | 23 for each id, i need to find job "start" to have user_id and _time, but i also need order_id, how can i do this? I need something like this: _time | id | order_id | job | user_id ------------------------------------------------------------------------------------ 2021-06-08 12:00:00 | 2240905 | 1066899 | start | 167 ------------------------------------------------------------------------------------ 2021-06-15 10:00:00 | 2240844 | 1055788 | start | 102 ------------------------------------------------------------------------------------ Thanks

_Mauro_Costa_ · ‎07-20-2021

if i use earliest and latest in the search, no results are shown, image attached. @inventsekar you're right, the logic of latest doesn't make sense but it doesn't influence the results. how search for earliest and latest using an inputlookup?

_Mauro_Costa_ · ‎07-15-2021

@inventsekar Thanks for the answer I'm not using the default _time but another date field that I converted to epoch is the problem related to this? my query is: | inputlookup dashboard_latest_v1 | eval _time=time | eval earliest = 1625698800 | eval latest = if(1626908400 < 0, now(), 1626908400) | where _time >= earliest AND _time <= latest | lookup zonef zf_id AS zonef_id OUTPUT cco_description | lookup client c_id AS cliente_id OUTPUT c_name | lookup project p_id AS project_id OUTPUT p_name | lookup contexto ci_id AS contexto_id OUTPUT ci_description | lookup partner par_id AS parceiro_id OUTPUT par_description | fillnull value=Others par_description | search segment = "internal" AND cco_description="*" AND c_name IN ("*") AND p_name IN ("*") AND ci_description IN ("*") AND par_description IN ("*") | timechart span=1d count BY segment

_Mauro_Costa_ · ‎07-15-2021

Good afternoon I have a dashboard with multiple timechart where I am using a time picker -7 days and +7 days. The problem is that not all timechart end on the same day because there are no events for future days. Is it possible that the timechar always represents future days, even when there are no events for those days? Image as an example:

_Mauro_Costa_ · ‎05-17-2021

Hello, I have a table of items and I need to convert the results in the rows "pa_name" and "pa_valor" to columns and keep the relacion of each one. An example, I have this: index="items" id IN (3438776 3131202 3438780) | stats latest(pa_nome) AS pa_nome latest(ipa_valor) AS ipa_valor BY id | makemv delim=";" pa_nome | makemv delim=";" ipa_valor I want this: Can someone help me?

Posts	9
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎05-17-2021

Online Status	Offline
Date Last Visited	‎03-30-2022 08:34 AM

FInd different value from "-" on column

Timechart future dates

Changing rows to columns and maintaining associati...

Re: FInd different value from "-" on column

FInd different value from "-" on column

Re: Timechart future dates

Re: Timechart future dates

Timechart future dates

Changing rows to columns and maintaining associati...