topic Re: fetching the count based on field value in Dashboards & Visualizations

fetching the count based on field value

sahana — Sat, 11 Dec 2021 18:29:35 GMT

I get a log in below format of JSON obj

message{

Dashboard{

status: SUCCESS

operationName:gettingResult

}

In the above logs i get a value of SUCCESS/FAILURE for status. Now my requirement is to calculate a total,totalSuccess and totalFailure based on operationName. Tried the below query but it is not working out

......messgae.Dashboard.status=*| stats count as total,count(eval(messgae.Dashboard.status=SUCCESS)) as totalSuccess, count(eval(messgae.Dashboard.status=FAILURE)) as totalFailure by messgae.Dashboard.operationName

getting value for total but not for totaSuccess /totalFailure

Re: fetching the count based on field value

ITWhisperer — Sat, 11 Dec 2021 18:52:50 GMT

Is it simply a typo in the field name? Or not having quotes around SUCCESS and FAILURE?

Re: fetching the count based on field value

sahana — Sun, 12 Dec 2021 01:27:22 GMT

It is simply a typo we don't have any quotes for success and failure

Re: fetching the count based on field value

ITWhisperer — Sun, 12 Dec 2021 08:08:33 GMT

Have you tried it with quotes around SUCCESS and FAILURE?

Re: fetching the count based on field value

sahana — Mon, 13 Dec 2021 05:28:04 GMT

Yes I have tried it also not working