I have a simple search parsing project activity logs to pull a list of projects and people working on those projects:
index="main" | dedup Author Proj_repo | stats list(Proj_repo) AS Project by Author
This successfully returns a list of Authors and list of their projects. What kind of function(s) could I use to chart the relationships between authors? Something showing the Authors and how they're linked to the other Authors across projects.
Here are some:
index="main" | rename Proj_repo AS Project
| eventstats count AS updates BY Author Project
| eval updatesThisAuthor = Project . ":" . updates
| eval updatesThisProject = Author . ":" . updates
| multireport
[ stats values(Project) dc(Project) values(updatesThisAuthor) BY Author ]
[ stats values(Author) dc(Author) values(updatesThisProject) BY Project ]
Ty for the pointer - One step forward 🙂
Here's a sample of the output columns I get:
Author Project dc(Author) dc(Project) values(Author) values(Project)
I get values under Author, dc(Project) and values(Project). All other columns are empty.
just noticed if I switch the stats func under mutli report I can get a value for dc(Author) so that gives me an additional value needed...
I had a typo and used count
instead of updates
. I edited the original answer to fix. Try it now.