Hello
I have a very long search(so I wont paste it all unless necessary) that tables a bunch of data. The field DaysPastDue is eval'd/calculated.
but heres the end of the search that tables the data:
|table AssessmentName RiskRank "Workflow Name" "Workflow Phase" "Workflow Process Name" "Workflow Step Name" SLA DaysPastDue "Workflow Step Sort Order"
|rename "Workflow Phase" AS "Phase Name" "Workflow Process Name" AS "Process Name" "Workflow Step Name" AS "Step Name" "Workflow Step Sort Order" as "Step Order"
| sort AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name" "Step Name"
Trying add a few more fields but I cant seem to think of HOW. Currently I have in the table: AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name" "Step Name" SLA DaysPastDue "Step Order"
AssessmentName RiskRank Workflow Name Phase Name Process Name Step Name SLA DaysPastDue Step Order
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Accounting and Audit Services RR RISK RANK PLAN Risk Rank Risk Rank Approved 3 0 2
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Accounting and Audit Services RR RISK RANK PLAN Risk Rank Risk Rank Reviewed 3 0 1
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Accounting and Audit Services RR RISK RANK PLAN Risk Rank Risk Rank Submitted by Business 2 0 0
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Consulting Services RR RISK RANK PLAN Risk Rank Risk Rank Approved 3 0 2
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Consulting Services RR RISK RANK PLAN Risk Rank Risk Rank Reviewed 3 0 1
Ernie and Oldguy - 2018 - Todd Ernie and Oldguy - Consulting Services RR RISK RANK PLAN Risk Rank Risk Rank Submitted by Business 2 0 0
Johnson Johnson and Johnson LLP - Legal Services - SIG Lite 2018 Johnson Johnson and Johnson LLP - Legal Services RR RISK RANK PLAN Risk Rank Risk Rank Approved 3 0 2
Johnson Johnson and Johnson LLP - Legal Services - SIG Lite 2018 Johnson Johnson and Johnson LLP - Legal Services RR RISK RANK PLAN Risk Rank Risk Rank Reviewed 3 0 1
Johnson Johnson and Johnson LLP - Legal Services - SIG Lite 2018 Johnson Johnson and Johnson LLP - Legal Services RR RISK RANK PLAN Risk Rank Risk Rank Submitted by Business 2 0 0
Roumen Test United Rentals Risk Rank 2 General Assessment Due Dilligence Internal Kickoff Completed 5 88 1
Roumen Test United Rentals Risk Rank 2 General Assessment Due Dilligence Internal Kickoff Scheduled 5 93 0
What Im trying to do next is create field called BEST that evaluates all of the "Step Name" for a given AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name" and returns the lowest value of DaysPastDue
BUT
I want to also keep the table above, so basically this would be another column after "Step Order"
Any ideas on how I could achieve this?
Thanks for the help!
YOu'd need eventstats command to calculate that which does the aggregation without affecting current result set (I mean unless you make the eventstats output column same as what you already have, you'd have you current result intact). Like this
..previous portion of search ...
|table AssessmentName RiskRank "Workflow Name" "Workflow Phase" "Workflow Process Name" "Workflow Step Name" SLA DaysPastDue "Workflow Step Sort Order"
|rename "Workflow Phase" AS "Phase Name" "Workflow Process Name" AS "Process Name" "Workflow Step Name" AS "Step Name" "Workflow Step Sort Order" as "Step Order"
| sort AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name" "Step Name"
| eventstats min(DaysPastDue) as BEST by AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name"
YOu'd need eventstats command to calculate that which does the aggregation without affecting current result set (I mean unless you make the eventstats output column same as what you already have, you'd have you current result intact). Like this
..previous portion of search ...
|table AssessmentName RiskRank "Workflow Name" "Workflow Phase" "Workflow Process Name" "Workflow Step Name" SLA DaysPastDue "Workflow Step Sort Order"
|rename "Workflow Phase" AS "Phase Name" "Workflow Process Name" AS "Process Name" "Workflow Step Name" AS "Step Name" "Workflow Step Sort Order" as "Step Order"
| sort AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name" "Step Name"
| eventstats min(DaysPastDue) as BEST by AssessmentName RiskRank "Workflow Name" "Phase Name" "Process Name"
For the win. I used the wrong search command.
Thanks again