I am looking to create a timechart. I have a base search that adds or subtracts "1" when certain events occur:
eval x=if(match(field_1,"xxx"),1,-1)
Then I accumulate them with:
| accum x AS total_x |
The problem is that there is another type of event "event_y". When this type of event occurs, I need to reset "total_x" to 0 and have it start accumulating again. I've been trying:
eval reset=if(match(field_2,"event_y"),total_x=0,total_x)
And then using that to create a timechart
Any suggestions as to how I can make the accum reset?
... View more