I'm trying to run a quarterly report that lists unique individuals in a building. The search lists each building name, individual, apartment, service address, and a number for that individual, then groups by organization and corporation and sums that number by the organization. The data lists these individuals multiple times so I'm using 'dedup Name' to narrow the results, as I want 1 number per individual. That works fine for a single month but I need to display this list for each month in the quarter on the same report.
Is there a way to deduplicate the name by date? perhaps a foreach statement?
current statement
index = csv | table "building name",Name,Apartment,Number,"Service Address",Org,Date,Corp | dedup Name | stats list("Building Name") list(Name) list(Apartment) list("Service Address") list(Number) sum(Number) by Corp,Org,Date
Maybe ?
index = csv
|bucket _time span=1d
| table "building name",Name,Apartment,Number,"Service Address",Org,Date,Corp
| dedup Name , Date
| stats list("Building Name") list(Name) list(Apartment) list("Service Address") list(Number) sum(Number) by Corp,Org,Date
Maybe ?
index = csv
|bucket _time span=1d
| table "building name",Name,Apartment,Number,"Service Address",Org,Date,Corp
| dedup Name , Date
| stats list("Building Name") list(Name) list(Apartment) list("Service Address") list(Number) sum(Number) by Corp,Org,Date
That's perfect. Thanks!