I have "version" and "Index" variables
"Version" contains values like: 150,160,170...
"Index" contains values like: 1,2,3,4,5
Basically I want to know if there's an implementation for this kind of condition:
max(Index) by Version
Meaning for the below 6 events:
150 , 5
140 , 1
140 , 2
130 , 1
130 , 2
130 , 3
Ill get only those 3:
150 , 5
140 , 2
130 , 3
Because it has only the highest index for every version
Thanks!
Couldn't implement this from Splunk documentation:
Aggregation
max([by=<grp>])
When you call max(by=<grp>), it returns one maximum for each value of the property or properties specified by <grp>. For example, if the input stream contains 5 different values for the property named datacenter, max(by='datacenter') outputs 5 maximums.
You can use the stats command to find the maximum Index value for each Version.
| stats max(Index) by Version
Basically I want to know if there's an implementation for this kind of condition:
max(Index) by Version
What you're asking for seem to be precisely how you would call max with stats:
index=ndx sourcetype=srctp Version=* datacenter=*
| stats max(Version) by datacenter
Does that not do what you're looking for?
Thanks guys!
Eventually what was the trick was "eventstats", because I wanted the highest index for each event
Related
I'm trying to do a query that will first aggregate by field count and after by bin(1h) for example I would like to get the result like:
# Date Field Count
1 2019-01-01T10:00:00.000Z A 123
2 2019-01-01T11:00:00.000Z A 456
3 2019-01-01T10:00:00.000Z B 567
4 2019-01-01T11:00:00.000Z B 789
Not sure if it's possible though, the query should be something like:
fields Field
| stats count() by Field by bin(1h)
Any ideas how to achieve this?
Is this what you need?
fields Field | stats count() by Field, bin(1h)
If you want to create a line chart, you can do it by separately counting each value that your field could take.
fields
Field = 'A' as is_A,
Field = 'B' as is_B
| stats sum(is_A) as A, sum(is_B) as B by bin(1hour)
This solution requires your query to include a string literal of each value ('A' and 'B' in OP's example). It works as long as you know what those possible values are.
This might be what Hugo Mallet was looking for, except the avg() function won't work here so he'd have to calculate the average by dividing by a total
Not able to group by a certain field and create visualizations.
fields Field
| stats count() by Field, bin(1h)
Keep getting this message
No visualization available. Try this to get started:
stats count() by bin(30s)
I want in the output a hierarchical order like so:
My Data :
Name | Cost | Level
----------------+--------+------
Car1 | 2000 | 1
Component1.1 | 3000 | 2
Component1.2 | 2300 | 3
Computer2 | 5000 | 1
Component2.1 | 2000 | 2
Component2.2 | Null | 3
Output: Show all those data, which has money in it and order it by the level, something like first 1, then 2, then,3 and after that start with 1 again.
Name | Level
------------------+------
Car1 | 1
Component1.1 | 2
Component1.2 | 3
Computer | 1
Component2.1 | 2
What ORDER BY does is:
Name | Level
----------------+------
Car1 | 1
Computer1 | 1
Component1.1 | 2
Component2.1 | 2
Component1.2 | 3
Component2.2 | 3
I tried the CONNECT BY PRIOR function and it didn't work well
SELECT Name, Level
FROM Product
CONNECT BY PRIOR Level;
In MySQL you would normaly use 'order by'. So if you want to order on table row "level" your synntax would be something like this:
SELECT * FROM items ORDER BY level ASC
You can make use of ASC (Ascending) or DESC (descending).
Hope this will help you.
You can use below one
SELECT Name, Level
FROM Auction
ORDER BY Name, Level
WHERE Money!='Null' ;
Doing order by Name will print the result in hierarchical order, but if it has a column called parent id, then it would have been easier to show.
i suggest this for you :
SELECT Name, Level FROM Product ORDER BY Name, Level WHERE Money!='Null' ASC;
i wish this help you brother
It is still not clear whether this is what you are really expecting. It seems to me from your data set, you want to numerically order the components based on some kind of a version number at the end of the component. If that's truly what you want then you may ignore the non-numeric characters in the name and order by pure numbers towards the end of string ( with the required where clause ).
ORDER BY REPLACE ( name, TRANSLATE(name,' .0123456789',' '),'');
If that's the case, then the adding level too to the ORDER BY shouldn't make any difference unless your numeric order of versions and level are in sync.
A problem may appear if you have components like component2_name1.2 etc which could break this logic, for which you may require REGEXP to identify the required pattern. But, it doesn't appear so from your data and I assumed that to be the case and you may want to clarify if that's not what you may always have in your dataset.
Here's a demo of the result obtained for your sample data.
Demo
This will work of the numeric character is always a valid decimal and has only one decimal point. If you have complex versioning system like say 1.1.8, 2.1.1 etc, it needs far sophisticated ordering on top of REPLACE ( name, TRANSLATE(name,' .0123456789',' '),'').
You will find such examples in posts such as this one Here
Note: I would request you to also please read the instructions here to know how to ask a good question. This would avoid all confusion to people who try to understand and answer your question.
I have seen a similar question asked How to get second highest value among multiple columns in SQL ... however the solution won't work for Microsoft Access (Row_Number/Over Partition isn't valid in Access).
My Access query includes dozens of fields. I would like to create a new field/column that would return the second highest value of 10 specific columns that are included in the query, I will call this field "Cover". Something like this:
Product Bid1 Bid2 Bid3 Bid4 Cover
Watch 104 120 115 108 115
Shoe 65 78 79 76 18
Hat 20 22 19 20 20
I can do a really long SWITCH formula such as the following equivalent Excel formula:
IF( AND(Bid1> Bid2, Bid1 > Bid3, Bid1 > Bid4), Bid1,
AND(Bid2> Bid1, Bid2 > Bid3, Bid2 > Bid4), Bid2,
.....
But there must be a more efficient solution. A MAXIF equivalent would work perfectly if MS-Access Query had such a function.
Any ideas? Thank you in advance.
This would be easier if the data were laid out in a more normalized way. The clue is the numbered field names.
Your data is currently organized as a Pivot (known in Access as crosstab), but can easily be Unpivoted.
This data is much easier to work with if laid in a more normalized fashion which is this case would be:
Product Bid Amount
--------- ----- --------
Watch 1 104
Watch 2 120
Watch 3 115
Watch 4 108
Shoe 1 65
Shoe 2 78
Shoe 3 79
Shoe 4 76
Hat 1 20
Hat 2 22
Hat 3 19
Hat 4 20
This way querying becomes simpler.
It looks like you want the maximum of the bids, grouped by Product, so:
select Product, max(amount) as maxAmount
from myTable
group by product
Really, we shouldn't be storing text fields at all, so Product should be an ID number, with associated Product Names stored once in a separate table, instead of several times in the this one, like:
ProdID ProdName
-------- ----------
1 Watch
2 Shoe
3 Hat
... but that's another lesson.
Generally speaking repeating of anything should be avoided... that's pretty much the purpose of a database... but the links below will explain than I. :)
Quackit : Microsoft Access Tutorial
YouTube : DB Planning
Microsoft : Database Design Basics
Microsoft : Database Normalization Basics
Wikipedia : Database Normalization
I am designing a system containing logical steps with some actions associated (but the actions are not part of the question, but they are crucial for each step in the list)!
The ting is that I need to create a way to define all the logical steps in an ordered way, so that I can get the list by query, and also make modifications later on!
Anyone with some experience in this kind of database design?
I have been thinking of having a column named wizard_steps (or something similar), and then use priority to make the order, but for some reason i feel that this design at some point will fail (due to items with same priority, adding new items would then have to rearrange the rest of the items, and so forth)!
Another design I have been thinking about is the use of "next item" as a column in the wizard_step column, but I don't feel this is the correct step eighter!
So to summarize; I am trying to make a list (and the design should be open enought to support multiple lists) of elements where the order is crucial!
Any ideas on how the database should look like?
Thanks!
EDIT: I found this yii component I will check out: http://www.yiiframework.com/extension/simpleworkflow/
Might be a good solution!
If I get you well, your main concern is to create a schema that supports ordered lists and can provide easy insert/reordering of items.
The following table design:
id_list item_priority foreign_itemdef_id
1 1 245
1 2 32
1 3 45
2 1 156
2 2 248
2 3 127
coupled to a table with item definition will be easily queried but will be difficult to maintain, especially for insertions
That one:
id_list first_item_id
1 45
2 38
coupled to the linked list:
item_id next_item foreign_itemdef_id
45 381 56
381 NULL 59
38 39 89
39 42 78
42 NULL 45
Will be both difficult to query and update (you should update the linked list inside a transaction, otherwise your linked list can get corrupted).
I would prefer the first solution for simplicity.
Depending on your update frequency, you may consider using large increments between item_priority to help insertion:
id_list item_priority foreign_itemdef_id
1 1000 245
1 2000 32
1 3000 45
2 1000 156
2 2000 248
2 3000 127
1 2500 46 -- late insertion
1 2750 47 -- late insertion
EDIT:
Here's a query that will hopefully make room for an insertion: it increments priority of all rows above the argument
$query_make_room_for_new_item = "UPDATE item_priority_table SET item_priority = item_priority + 1 WHERE item_priority > ". $new_item_position_priority ." AND id_list = ".$id_list;
Then insert your item with priority $new_item_position_priority
I have a Jasper report with the following output format:
Item | Price | Quantity
----------------------------
1 100 5
2 150 8
3 200 11
How do I make that table to this format:
Item 1 2 3
Price 100 150 200
Quantity 5 8 11
The column headers have now become row headers.
I'm actually using DynamicJasper, but of course, it's still relies on Jasper.
What special setting or property should I set to achieve the format I'm looking for.
Also, what do you call this format? Inverted Headers? Inverted Columns? It's hard to Google this issue since the keywords I'm using doesn't seem to be correct. Google always gives me a different answer.
Please check if Crosstabs serve your purpose
As it was suggested before, either check out crosstab, or you can check their CrosstabBuilder/LayoutManager classes and probably override/extend some to adopt to your needs