Filter for using a unique value regardless of date

[pball (Peggy Ball)]

Hi All, I have searched and read many articles but have not found an answer or post which matches my criteria.

This is a very simplistic example but I hope it makes it clear. I have 5 users and 3 bats. The green bat has a problem so I need to filter out the users who only only ever use the green bat, in this sample it would be Ryan and Susie, regardless of of date.

Example data:
|Date|User|Bat Used|
|1/5/2020|Bob|blue bat|
|1/5/2020|Joe|blue bat|
|1/5/2020|Sally|red bat|
|1/5/2020|Susie|green bat|
|1/5/2020|Ryan|green bat|
|1/6/2020|Bob|red bat|
|1/6/2020|Joe|red bat|
|1/6/2020|Sally|red bat|
|1/6/2020|Susie|green bat|
|1/6/2020|Ryan|green bat|
|1/7/2020|Bob|blue bat|
|1/7/2020|Joe|blue bat|
|1/7/2020|Sally|red bat|
|1/7/2020|Susie|green bat|
|1/7/2020|Ryan|green bat|
|1/8/2020|Bob|blue bat|
|1/8/2020|Joe|green bat|
|1/8/2020|Sally|green bat|
|1/8/2020|Susie|green bat|
|1/8/2020|Ryan|green bat|

I created a data table and with users for rows and I can set the columns to show the unique count of bat used - Bob and Sally = 2, Joe = 3, and Ryan and Susie = 1. I also tried column filters by bat which is correct but when I try to filter just for the green bat, I also get Joe and Sally who don't meet the criteria as they also used other bats.

How can I isolate just Ryan and Susie? I don't have the timestamp in the visualization but I should come up with a count of 2.

Thanks for the help!

[Adriann (Adrian)]

I guess with some fancy coding you could use a script field(It will be deprecated in some new versions in fewer of the runtime field if I remember correctly). You can also look at ingest pipeline script processor and runtime field.

This is an example of a script field that I needed for displaying time for uptime in a way I wanted it.

String val = "system.uptime.duration.ms";

if (doc[val] != null){ 

    if (doc[val].size() != 0 ){

        long now = doc["@timestamp"].value.toInstant().toEpochMilli();

        long elapsedTime = now - doc['system.uptime.duration.ms'].value;

        return elapsedTime;
    }
}