Our event lists the answer to one question on a test.
Our test numbers are unique to one set of test questions by one student at the time they took the test.
I can handle grading the tests using eval(grade_function) by test_number (e.g. grade=B)
Students can take the test at any time and retake the test as many times as they want or only take the test once.
I want to track the student's progress every month.
Thus for every student, I want to get their last test results before each months end and plot the number of students who achieved each grade. Note the last test result for a student may appear many months before the current month end.
This should look like a bar or line graph and each X axis value is a month and each bar at an X value represents a count of the number of "A", "B", "C", and "D" grades.
The first part I think I can handle by processing the list of events by test number and generating statistics as a table.
Once I have done this, I have no "test" events (only lines in a table) to order or search by or sum up results.
I don't know if there is a way to turn a table into a series of events.
I also realize I may be very far off the way to use Splunk to process the data.
