Hello,
I am trying to track a a version upgrade rollout of an application in our environment. I would like to see a pie graph showing percentage of the old version verses the new version. The index and sourcetype are the same ( index=fee sourcetype=events). However, the versions of the upgrade are in 2 different fields ( AgentVersionold=9.3 AgentVersionnew=10.0) . How can get this info a pie graph? Thanks
You could use the coalesce command to merge the two fields into a single field:
BASE SEARCH | eval AgentVersion = coalesce(AgentVersionold,AgentVersionnew) | stats count by AgentVersion
index=fee sourcetype=events
| eval AgentVersion=coalesce(AgentVersionold, AgentVersionnew, 0.0)
| stats count by AgentVersion