Some progress... Using a "join" I can get the correct total # of calls without losing the correct total call time:
...same search... | stats count as "Total # calls" sum(duration) | stats count as "Total calls" | join type=left [ ...same search... | dedup call_start caller | stats count as "Correct total calls" ]
But the other stats are still incorrect. Ideally, I think, all records that have both identical call_start and identical caller, should be merged into one. So records 1 and 2 would become, say:
2016/09/02_16:49:40 0049026084395 5+1 00:00:00+00:02:19
No information is lost, it just needs a bit more processing. Can this be done?
... View more