Hey everyone,
I am trying to blend field values from subcategory events that are related by a key. I can group them together with a transaction, but when i try to stats the values into a report separated by their subcategory the fields don't stick. let me draw a mock table...
Catagory: OrderID: UserID: EmpID:
order_placed 10101 abc1234
processing 10101 5678910
shipped 10101 5678910
the regular logs have specific fields, but in the generated report i need individual lines for each catagory of event, but with all the related fields filled so it would look like this:
Catagory: OrderID: UserID: EmpID:
order_placed 10101 abc1234 5678910
processing 10101 abc1234 5678910
shipped 10101 abc1234 5678910
any help on this? i know i'm missing something here..
So you essentially want to fill empty UserID and EmpID values by OrderID? Try something like this:
... | eventstats values(UserID) as UserID values(EmpID) as EmpID by OrderID | ...
So you essentially want to fill empty UserID and EmpID values by OrderID? Try something like this:
... | eventstats values(UserID) as UserID values(EmpID) as EmpID by OrderID | ...
this is perfect, i'm testing now, but it seems to fix my problems, thanks!