Hi,
Someone will probably come up with a rangemap based solution. I played around with something else here, you could try
<your base search> | streamstats values(eval(if(Minutes>100 AND Minutes<500, Store, null()))) as a, values(eval(if(Minutes>30 AND Minutes<40, Store, null()))) as b | tail 1 | eval a=mvjoin(a,","), b=mvjoin(b,",") | table a b | rename a as "40>Minutes>30", b as "500>Minutes>100"
Adjust the parameters to your need and add as many more columns as needed.
To test this out, I used your example data (changing 42 to 32 so it actually falls into the first category) in a run-everywhere snippet:
| makeresults | eval input="81135,33%81234,32%87654,120%87699,400" | makemv delim="%" input | mvexpand input | rex field=input "(?<Store>\d+),(?<Minutes>\d+)" | streamstats values(eval(if(Minutes>100 AND Minutes<500, Store, null()))) as a, values(eval(if(Minutes>30 AND Minutes<40, Store, null()))) as b | tail 1 | eval a=mvjoin(a,","), b=mvjoin(b,",") | table a b | rename a as "40>Minutes>30", b as "500>Minutes>100"
Hth, but wait for someone else to jump in. I am sure there is a more elegant solution. 😉
... View more