Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to sum values in a table with a condition that compares columns?

$
0
0
Hi, I've got a table like this ts1 | ts2 | count | id 1461347440 | 1461347448 | 5 | 1234 1461347459 | 1461347452 | 10 | 1234 1461347455 | 1461347459 | 10 | 7899 I would like to sum "count" if `ts1<=ts2`, for each id. My approach looks like this, but it seems to fail because of the field comparison | eventstats sum(eval(if(ts1

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>