[search earliest=2/1/2015:00:00:00 latest=2/1/2015:23:59:59 ns=interaction (msg=yes direction=sent) OR (msg=match) | fields uid o_uid] earliest=2/2/2015:00:00:00 latest=2/5/2015:23:59:59 ns=interaction msg=single_message OR msg=eis | chart count by msg direction
In the query above I search for uid
s who sent engagement to o_uid
s on 2/1 and then in the second portion of the query I search for all engagment that was sent for that same uid
/ o_uid
pair.
My issue is that when someone who is on the receiving end of engagement, an o_uid
, sends something back, the uid
/ o_uid
pair reverses (in terms of the field name) and I want to be able to capture that data.
Since I have all the IDs, I need a a way to say "also search for the reverse, for each pair where the uid
becomes the o_uid
and vice versa.
Is it possible to switch the field names like this?
Your best bet would be to search one direction, use the "rename" command (if needed), and then use the "append" command to perform the same search in the other direction, with another "rename" command in that.
Your best bet would be to search one direction, use the "rename" command (if needed), and then use the "append" command to perform the same search in the other direction, with another "rename" command in that.