Hi
I get a log in below format of JSON obj
message{
Dashboard{
status: SUCCESS
operationName:gettingResult
}
In the above logs i get a value of SUCCESS/FAILURE for status. Now my requirement is to calculate a total,totalSuccess and totalFailure based on operationName. Tried the below query but it is not working out
......messgae.Dashboard.status=*| stats count as total,count(eval(messgae.Dashboard.status=SUCCESS)) as totalSuccess, count(eval(messgae.Dashboard.status=FAILURE)) as totalFailure by messgae.Dashboard.operationName
getting value for total but not for totaSuccess /totalFailure
Is it simply a typo in the field name? Or not having quotes around SUCCESS and FAILURE?
It is simply a typo we don't have any quotes for success and failure
Have you tried it with quotes around SUCCESS and FAILURE?
Yes I have tried it also not working