Dynamic | stats count

MrJohn230 — Wed, 10 Jan 2024 20:00:20 GMT

I'm not exactly sure what I need here.

I have a multiselect:

<input type="multiselect" token="t_resource"> <label>Resource</label> <choice value="*">All</choice> <prefix>IN(</prefix> <suffix>)</suffix> <delimiter>,</delimiter> <fieldForLabel>resource</fieldForLabel> <fieldForValue>resource</fieldForValue> <search base="base_search"> <query>| dedup resource | table resource</query>

Table visual search:

| search status_code $t_code$ resource $t_resource$ HourBucket = $t_hour$ | bin _time span=1h | stats count(status_code) as StatusCodeCount by _time, status_code, resource | eventstats sum(StatusCodeCount) as TotalCount by _time, resource | eval PercentageTotalCount = round((StatusCodeCount / TotalCount) * 100, 2) | eval 200Flag = case( status_code=200 AND PercentageTotalCount < 89, "Red", status_code=200 AND PercentageTotalCount < 94, "Yellow", status_code=200 AND PercentageTotalCount <= 100, "Green", 1=1, null) | eval HourBucket = strftime(_time, "%H") | table _time, HourBucket, resource, status_code, StatusCodeCount, PercentageTotalCount, 200Flag

I also have a table, sample data below:

_time	resource
1/10/2024	Red
1/10/2024	Green

When the user select the multiselect dropdown and selects "ALL" (which is the default) the resource column should aggregate all the resource and display the resource as "All". But If the user select individual resources, such as "Red" and "Green" these should be shown and broken down by resource.

Re: Dynamic | stats count

bowesmana — Wed, 10 Jan 2024 22:47:34 GMT

You could do a simple

| eval resource=if($t_resource|s$="IN(*)", "All", resource)

which would make all resources be "All" if the only selected dropdown is "All", so the split by resource only creates a single split, of you could add a change element to the input that sets the split by clause, e.g. something like

<change> <eval token="split_by_resouce">if($t_resource|s$="IN(*)", "", "resource")</eval> </change>

and then change your stats (and eventstats) command to

| stats count(status_code) as StatusCodeCount by _time, status_code, $split_by_resource$

You would also need a default for that token, so need an init block, i.e.

and then you would also need to create a 'resource' field to be "All" for the final table display if you want "All" to appear. The first option requires the least fiddling around

topic Dynamic | stats count in Dashboards & Visualizations

Dynamic | stats count

Re: Dynamic | stats count