Hi All,
I am splitting a Description field with "space" using Split command and generating list of keywords ( doing sort of text analytics) and doing the stats count by keywords to find top count of keywords in the data. The problem is, there is an "order" keyword which is coming twice in the Description, but I want to take the unique count of the keyword or remove the duplicate so that I can get the proper count of that "keyword" presence in that specific ticket Description field. Please help me how can I do that ? Following is my query, INC00001 is specific ticket number:
Description field has this text --> **Order #1111111 Order date #06/25/13 client needs to process return but the invoice hasn't dropped yet**
index=abc source="abc.csv" INC0001 | eval words=split(Description," ")| stats count by words
Getting following output from this query :
**Order 2**
but 1
date 1
dropped 1
hasn't 1
invoice 1
needs 1
process 1
return 1
the 1
to 1
yet 1
I want the query, that should count **Order** as one event instead of 2, as it is part of same ticket Description. I tried doing dedup but that is not working. I have to do this for ~15K ticket events for whatever top keyword counts I will be getting. But first I am trying to get it worked for single ticket event. Please help, this is quite urgent.
Regards
Pankaj
↧