Hello,
I have this query that return me the table below.
The query :
| loadjob savedsearch="myquery"
| where (strftime(_time, "%Y-%m-%d") >= "2019-12-09") AND (strftime(_time, "%Y-%m-%d") <= "2019-12-10")
| stats dc(eval(if(((STEP=="Recieved",ID_MESSAGE,NULL))) AS Recieved,
dc(eval(if(((STEP=="answered",ID_MESSAGE,NULL))) AS answered,
dc(eval(if(((STEP=="deleted",ID_MESSAGE,NULL))) AS deleted by client
|fields client,Recieved,answered,deleted
Result :
The problem is , for some client like "35535" he receieved the Message 10/12 but he answered the 12/12, i want to give my client a margin of 4 days.
So,if my client recieves the message between the 09/12 and 10/12, i will check if his answered between the 09/10 and the 14/12.
the messages received and deleted must be over the period from 09/12 and 10/10, but those answered must be from 09/12 and 14/12
Thanks 🙂
... View more