Hi! I would like to know the frequency of each value of a certain field inside a transaction, for example: my event after transaction (mvlist=t) are
23/07/2013 17:09 userdi1 value1
userid1 value2
userid1 value1
userid1 value3
userid1 value2
userid1 value1
23/07/2013 14:09 userid2 value2
userid2 value2
userid2 value2
userid2 value3
userid2 value2
userid2 value3
I wish to get the result:
23/07/2013 17:09 userdi1 value1 3
value2 2
value3 1
23/07/2013 14:09 userid2 value2 4
value3 2
I think to need transaction because in my log I have more than one "event" (section) for the same user. This search
index=ing sourcetype=callcenter | transaction maxpause=30m cif mvlist=t | stats count(value) by value
doesn't work. My impression is that top or something similar inside a transaction without breakink it it impossible. Any suggestion? Thanks for your time