Hi, I wondered whether someone may be able to help me please.
I'm using the query below which works but contains duplicate id numbers under field "detail.ur"
index=main auditSource=preferences-frontend auditType=TxSucceeded tags.transactionName="Show Print Preference Option"
|eval Interstitpage=if('detail.journey'="Interstitial",1, 0 )
|eval AccountPage=if('detail.journey'="AccountDetails",1, 0 )
|timechart span=1d sum(Interstitpage) AS ShownInterstitial, sum(AccountPage) AS ShownAccountPage
|reverse
I'm trying to incorporate the "stats dc" command to remove these duplicates rather than the dedup because there are a lot of records involved and I know the dedup can be a little inefficient.
I've tried incorporating the "stats dc" in multiple areas of the query but I just can't get this to work.
I just wondered whether someone may be able to point me in the right direction so I may be able to get this to work.
Many thanks and kind regards
Chris
↧