Recently I was working on a lab module 12 - question 22: Search the web application data for all events where a user purchased a product successfully. Use the stats sum function to sum the Price field by ProductName. Name the resulting field Revenue.
Originally I typed the following query but did not get any results:
index=main sourcetype=access_combined_wcookie status=200 file=success.do | stats sum(Price) as Revenue by ProductName (I tried it both with quotes and without quotes around "access_combined_wcookie)
I tried a few things before I scrolled down to see if the answer was any different and I discovered that it was. The only difference that I saw in my opinion do not seem to me like they should affect the results that are returned. Can anyone provide some insight into why the order of the search terms would matter or is this a weird fluke?
↧