Hello,
I have a search that I n
index="" host= sourcetype=csv source=C:\\.......\.csv
| dedup CR_ID
| table CR_SubmitDate CR_LMC PVER_SpecificationFreeze
| eval LMC_Requested = case(match(CR_LMC, "Yes"),"yes")
| search LMC_Requested="yes"
| eval LMC_Planned = case(CR_SubmitDate > PVER_SpecificationFreeze, "True")
| search LMC_Planned="True"
| chart count by LMC_Requested, LMC_PLanned
eed to count the values that matches "Yes". But the way I did is making conflict somewhere. How do I make a clean match that does not male problems with the chart?
The way this search appears to be written is that you are counting the events where CR_LMC matches "Yes" and CR_SubmitDate > PVER_SpecificationFreeze, so why not simplify to
index="" host= sourcetype=csv source=C:\\.......\.csv
| dedup CR_ID
| table CR_SubmitDate CR_LMC PVER_SpecificationFreeze
| where match(CR_LMC, "Yes") AND CR_SubmitDate > PVER_SpecificationFreeze
| stats count