Is it possible to create a transaction on an eval field after passing through stats?
... | stats sum(total) as total sum(units) as units by AccountID Action Item | transaction mvlist=t AccountID
AccountID is a field created by an extractor, when I try run the transaction after stats, I get no results. There are a handful of eval's prior to the stats command.
From the transaction
page in the search reference:
Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.
When you've run stats
, there is no longer a _raw
field for transaction
to use.
Your search looks kind of weird - what do you want to use transaction
on your stats results for?
From the transaction
page in the search reference:
Given events as input, finds transactions based on events that meet various constraints. Transactions are made up of the raw text (the _raw field) of each member, the time and date fields of the earliest member, as well as the union of all other fields of each member.
When you've run stats
, there is no longer a _raw
field for transaction
to use.
Your search looks kind of weird - what do you want to use transaction
on your stats results for?
Yeah, I was thinking something along those lines 🙂
Good that you got it working!
purely for report layout purposes. I want the left column to have the AccountID (once) and then the next column to list the items. When using a transaction, i can display multiple fields. I guess I could use something like the stats list
function.
Edit
Have just tested and list works perfectly:
... | stats list(Item) as Item list(units) as Units list(total) as Total by AccountID Action