I am trying to achieve a simple pie chart that will display from two different stats query command
| inputlookup records.csv where condition1=compliant | stats count(host) as compliant
| append records.csv where (condition2=noncompliant AND condition3=noncompliant and condition4=noncompliant)| stats count(host) as noncompliant
| <I am missing a command at this point in able to produce the pie chart below>
Please advise. Thanks and regards.
Here's one approach:
| inputlookup records.csv
| eval status=if( (condition1="noncompliant") OR (condition2="noncompliant" AND condition3="noncompliant" AND condition4="noncompliant"),"NC","C")
| stats count(host) by status
BTW, you don't need a
stats count(host)
because you are just counting records, so
stats count
would also work.
Thanks, this worked.
Here's one approach:
| inputlookup records.csv
| eval status=if( (condition1="noncompliant") OR (condition2="noncompliant" AND condition3="noncompliant" AND condition4="noncompliant"),"NC","C")
| stats count(host) by status
BTW, you don't need a
stats count(host)
because you are just counting records, so
stats count
would also work.