Hi this my search results
COUNTRY avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER)
1 268647320 462.000000
2 268647324 404.000000
3 268647325 483.000000
4 268713740 90.000000
5 268755211 95.000000
6 268755212 81.000000
7 268910904 47.000000
8 ALBANIA 78.885057
9 ALGERIA 162.192308
10 ANDORRA 72.083333
11 ANGOLA 87.625000
12 ARGENTINA 131.596965
13 ARMENIA 124.333333
14 AUSTRALIA 119.199497
15 AUSTRIA 140.973917
16 AZERBAIJAN 136.800000
17 BAHAMAS 200.375000
18 BAHRAIN 102.406360
I want only countries to be displayed,i want to eliminate first numbers from COUNTRY field.
My search query is
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | table CUS_OBJID,COUNTRY,CITY,ORDER_CREATED_DATE,ORDER_END_DATE | eval j2=ORDER_END_DATE | eval j1=ORDER_CREATED_DATE | eval d1=strptime(j1,"%d-%b-%y") |eval d2=strptime(j2,"%d-%b-%y") | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER = (d2-d1)/86400 | eval TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER=round(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER,2) |table COUNTRY,CITY,TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER | stats avg(TIME_TAKEN_IN_DAYS_TO_COMPLETE_THE_ORDER) by COUNTRY
Please help me
As a general tip regarding your search - you don't need the two table
command you have in there.
You can get rid of the country values starting with a digit by adding a where
command after your initial search command...
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...
As a general tip regarding your search - you don't need the two table
command you have in there.
You can get rid of the country values starting with a digit by adding a where
command after your initial search command...
source="-----------------------------" NOT "COUNTRY" ORDER_END_DATE!=" " | where !match(COUNTRY,"^\d") | ...
No problem. Please mark my answer as accepted if it solved your problem.
thanks.................