|
@@ -290,23 +290,35 @@ null
|
|
|
;
|
|
|
|
|
|
byStringAndLong
|
|
|
-from employees | eval trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000 | stats c = count(gender) by gender, trunk_worked_seconds | sort c desc;
|
|
|
+FROM employees
|
|
|
+| EVAL trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000
|
|
|
+| STATS c = COUNT(gender) by gender, trunk_worked_seconds
|
|
|
+| SORT c desc;
|
|
|
|
|
|
c:long | gender:keyword | trunk_worked_seconds:long
|
|
|
-30 | M | 300000000
|
|
|
-27 | M | 200000000
|
|
|
-22 | F | 300000000
|
|
|
-11 | F | 200000000
|
|
|
+30 | M | 300000000
|
|
|
+27 | M | 200000000
|
|
|
+22 | F | 300000000
|
|
|
+11 | F | 200000000
|
|
|
+ 0 | null | 200000000
|
|
|
+ 0 | null | 300000000
|
|
|
;
|
|
|
|
|
|
byStringAndLongWithAlias
|
|
|
-from employees | eval trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000 | rename gender as g, trunk_worked_seconds as tws | keep g, tws | stats c = count(g) by g, tws | sort c desc;
|
|
|
+FROM employees
|
|
|
+| EVAL trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000
|
|
|
+| RENAME gender as g, trunk_worked_seconds as tws
|
|
|
+| KEEP g, tws
|
|
|
+| STATS c = count(g) by g, tws
|
|
|
+| SORT c desc;
|
|
|
|
|
|
c:long | g:keyword | tws:long
|
|
|
-30 | M | 300000000
|
|
|
-27 | M | 200000000
|
|
|
-22 | F | 300000000
|
|
|
-11 | F | 200000000
|
|
|
+30 | M | 300000000
|
|
|
+27 | M | 200000000
|
|
|
+22 | F | 300000000
|
|
|
+11 | F | 200000000
|
|
|
+ 0 | null | 200000000
|
|
|
+ 0 | null | 300000000
|
|
|
;
|
|
|
|
|
|
byStringAndString
|
|
@@ -324,35 +336,45 @@ c:long | gender:keyword | hire_year_str:keyword
|
|
|
;
|
|
|
|
|
|
byLongAndLong
|
|
|
-from employees | eval trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000 | stats c = count(languages.long) by languages.long, trunk_worked_seconds | sort c desc, languages.long, trunk_worked_seconds;
|
|
|
+FROM employees
|
|
|
+| EVAL trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000
|
|
|
+| STATS c = COUNT(languages.long) BY languages.long, trunk_worked_seconds
|
|
|
+| SORT c DESC, languages.long, trunk_worked_seconds;
|
|
|
|
|
|
c:long | languages.long:long | trunk_worked_seconds:long
|
|
|
-15 |5 |300000000
|
|
|
-11 |2 |300000000
|
|
|
-10 |4 |300000000
|
|
|
-9 |3 |200000000
|
|
|
-8 |1 |200000000
|
|
|
-8 |2 |200000000
|
|
|
-8 |3 |300000000
|
|
|
-8 |4 |200000000
|
|
|
-7 |1 |300000000
|
|
|
-6 |5 |200000000
|
|
|
+15 |5 |300000000
|
|
|
+11 |2 |300000000
|
|
|
+10 |4 |300000000
|
|
|
+9 |3 |200000000
|
|
|
+8 |1 |200000000
|
|
|
+8 |2 |200000000
|
|
|
+8 |3 |300000000
|
|
|
+8 |4 |200000000
|
|
|
+7 |1 |300000000
|
|
|
+6 |5 |200000000
|
|
|
+0 |null |200000000
|
|
|
+0 |null |300000000
|
|
|
;
|
|
|
|
|
|
byUnmentionedLongAndLong
|
|
|
-from employees | eval trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000 | stats c = count(gender) by languages.long, trunk_worked_seconds | sort c desc, trunk_worked_seconds;
|
|
|
+FROM employees
|
|
|
+| EVAL trunk_worked_seconds = avg_worked_seconds / 100000000 * 100000000
|
|
|
+| STATS c = count(gender) by languages.long, trunk_worked_seconds
|
|
|
+| SORT c desc, trunk_worked_seconds;
|
|
|
|
|
|
c:long | languages.long:long | trunk_worked_seconds:long
|
|
|
-13 |5 |300000000
|
|
|
-10 |2 |300000000
|
|
|
-9 |3 |200000000
|
|
|
-9 |4 |300000000
|
|
|
-8 |4 |200000000
|
|
|
-8 |3 |300000000
|
|
|
-7 |1 |200000000
|
|
|
-6 |2 |200000000
|
|
|
-6 |1 |300000000
|
|
|
-4 |5 |200000000
|
|
|
+13 |5 |300000000
|
|
|
+10 |2 |300000000
|
|
|
+ 9 |3 |200000000
|
|
|
+ 9 |4 |300000000
|
|
|
+ 8 |4 |200000000
|
|
|
+ 8 |3 |300000000
|
|
|
+ 7 |1 |200000000
|
|
|
+ 6 |2 |200000000
|
|
|
+ 6 |null |300000000
|
|
|
+ 6 |1 |300000000
|
|
|
+ 4 |null |200000000
|
|
|
+ 4 |5 |200000000
|
|
|
;
|
|
|
|
|
|
byUnmentionedIntAndLong
|