hello
In a panel table, I need to display every key_path even if the key_path result = 0
I have done an if condition but it doenst works
could you help me please??
index="toto" sourcetype="WinRegistry" key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx" OR key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\yy" OR key_path="HKLM\\software\\wow6432node\\zz"
| stats dc(host) as test by sourcetype key_path
| eval test=if(test==0,"0", test)
@jip31
Can you please try this?
index="toto" sourcetype="WinRegistry" key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx" OR key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\yy" OR key_path="HKLM\\software\\wow6432node\\zz"
| stats dc(host) as count by sourcetype key_path | append [| makeresults | eval sourcetype="WinRegistry", count=0, key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx||HKLM\\software\\microsoft\\windows nt\\currentversion\\yy||HKLM\\software\\wow6432node\\zz",key_path=split(key_path,"||") | mvexpand key_path | table sourcetype key_path count] | stats sum(count) as count by sourcetype key_path
@jip31
Can you please try this?
index="toto" sourcetype="WinRegistry" key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx" OR key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\yy" OR key_path="HKLM\\software\\wow6432node\\zz"
| stats dc(host) as count by sourcetype key_path | append [| makeresults | eval sourcetype="WinRegistry", count=0, key_path="HKLM\\software\\microsoft\\windows nt\\currentversion\\xx||HKLM\\software\\microsoft\\windows nt\\currentversion\\yy||HKLM\\software\\wow6432node\\zz",key_path=split(key_path,"||") | mvexpand key_path | table sourcetype key_path count] | stats sum(count) as count by sourcetype key_path
hi its perfect thanks!
Great @jip31. Can you please upvote and accept this answer to close this question?