I have results in the following form and would like to filter for only those results matching a session_id=x and an object_id=y, or those first encountered in the results. Any ideas?
Session_Id | Object_Id
x | y
x | y
x | z
x | z
x | z
a | b
a | b
a | c
The expected output would be the events outlined in the following table, in which all events matching the first combination of session_id, object_id are allowed, when grouping by session_id.
Session_Id | Object_Id
x | y
x | y
a | b
a | b
I hope the last row in expected output is a | c
. With that try this
Your current query giving current result with field Session_Id, Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank
I hope the last row in expected output is a | c
. With that try this
Your current query giving current result with field Session_Id, Object_Id | streamstats count as rank by Session_Id | where (Session_Id="x" AND Object_Id="y") OR rank=1 | fields - rank
Thank you very much. That has led me in the right direction. I do want to filter out the a | c value, which I've been able to do now by applying stream stats to both fields, and then taking their difference. Any non-zero value would then indicate the items I would like to filter out.
streamstats count as session_rank by session_id | streamstats count as object_rank by object_id | eval request_rank=(session_rank-object_rank)
If these are the results, what is the expected output?
I have edited the post, hopefully addressing your question.