hi
I have the search below
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup aps.csv NAME as AP_NAME OUTPUT Building
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| stats last(Building) as BuildingAP, last(BUILDING_DESCRIPTION) as BuildingIT
What I need is to do a pie chart in order to have the percentage of the events where BuildingAP doesnt match with BuildingIT
So first, I have to write this where condition
After I need to count the number of events corresponding to this where condition and to count also the total number of events (events without the where condition) in order to have 2 news fields which allows doing a pie chart
but pearhaps there is another solution?
For summarize I need a pie chart with 2 label in %, one which calculate the % of events where BuildingAP is not equal to BuildingIT and another which is the equal tio the total % of events - the % the previous count
Is anybody cant help me please??
Try something like this and change according to what you are trying to compare:
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup aps.csv NAME as AP_NAME OUTPUT Building
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual
Ii there somebody for helping me please??
Is anybody has an idea please??
Hi jip31,
Try something like this:
`test`
[ | inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup aps.csv NAME as AP_NAME OUTPUT Building
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| search NOT (Building = BUILDING_DESCRIPTION)
| stats count
Bye.
Giuseppe
Hi
I have no results (pie empty only....)
Try something like this and change according to what you are trying to compare:
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup aps.csv NAME as AP_NAME OUTPUT Building
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual
Hi
it doesnt works
I have the message " Error in 'eval' command: The arguments to the 'case' function are invalid."
can you try again? there was a typo on the case arguments (missing ")