cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Summarize terms in a record

wellpplava
Participant

Hello!

I have log lines when a customer makes a purchase. This log contains the ID of the purchased products. I would like to be able to quantify the best-selling products of the day.

Example:

message: TUP15451, TUP41234, TUP52351152.

It's possible?

9 REPLIES 9

dannemca
DynaMight Guru
DynaMight Guru

Considering the productID is a field, you can do "| summarize count(), by: {productID} " at the end of your query.

https://docs.dynatrace.com/docs/platform/grail/dynatrace-query-language/commands/aggregation-command...

Site Reliability Engineer @ Kyndryl

but I have multiple products, something like: "PRODUCTS: TPU 123, TPU 1942, TPU9724"

You mean, in the same line you have multiple values for the productID field?

 

Site Reliability Engineer @ Kyndryl

Yes!!  

I'm almost there!What's left is to refine my parseAll because it's not getting the last value




@dannemca wrote:

You mean, in the same line you have multiple values for the productID field?

 


data record(timestamp = "12/24/2022", content = "Products: SKU1234, SKU1234, SKU12345"),
record(timestamp = "12/25/2022", content = "Products: SKU123, SKU1234, SKU12345")

 

| fieldsAdd ProductID = parseAll(content, "BLANK LD:pid PUNCT")
| expand ProductID
| summarize count(), alias: Occurrences, by:ProductID

Got it now, try to replace the LD by WORD in your parseAll:

data record(timestamp = "12/24/2022", content = "Products: SKU1234, SKU1234, SKU12345"),
record(timestamp = "12/25/2022", content = "Products: SKU123, SKU1234, SKU12345")
| fieldsAdd ProductID = parseAll(content, "BLANK WORD:pid")
| expand ProductID
| summarize count(), alias: Occurrences, by:ProductID

Regards.

Site Reliability Engineer @ Kyndryl

@dannemca 

We received the official registration format. Perhaps it would be possible to adapt parse to capture what is just between {[[ and ]]}?

I tried with DATA "{[[" but I was unsuccessful

 

PARITY_CATEGORY and fields: {[[TKU12345, TKU123456, TKU123451, TKU59156]]}

If you have comma separated array of words it quite easy to do using just DPL or DPL + splitString:

data record(content="blabla blabla Products: {[[TKU12345, TKU123456, TKU123451, TKU59156]]} bla bla")
| parse content, "DATA '{[[' LD:products ']]}' DATA" 
| fieldsAdd product=trim(splitString(products,",")[])

or

data record(content="blabla blabla Products: {[[TKU12345, TKU123456, TKU123451, TKU59156]]} bla bla")
| parse content, "DATA '{[[' ARRAY{WORD*:i ', '*}{1,100}:product ']]}' DATA" 

 

krzysztof_hoja_0-1711650130772.png

Kris

 

| parse content, "DATA '{[[' ARRAY{WORD*:i ', '*}{1,100}:product ']]}' DATA" 

this worked great! Thank you very much!

Could you explain to me how it works?

Featured Posts