I'm trying to do a simple thing but I'm not able to figure it out.
so, my problem is that I want to produce a table based on a condition, like below:
if condition=TRUE, stats values(A) as A, values(B) as B by C, ("ELSE") stats values(Z) as Z, values(X) as X by Y
SO, if the condition is true I want to built a table with certain variables, otherwise with some others.
you need to move the logic outside of the stats command in this case, try something like this:
base SPL here | eval A=if(condition=TRUE, A, Z), B=if(condition=TRUE, B, X), C=if(condition=TRUE, C, Y) | stats values(A) AS A, values(B) AS B by C
Hope this helps ...
Thanks MuS, this is almost perfect, only issue is that as results of the stats I get always A, B, C as field names, other than that everything else is good.
would you know how to change dynamically the field names as result of the eval if?
Thanks very much, appreciated.
I reckon the only way to get this working like this would be in a dashboard and use token to replace the values. I don't think this is possible in ad-hoc search.
You could do something like this:
index="_*" | eval foo="bar" | multireport [stats count first(foo) AS foo BY index | where foo="bar" ] [stats count first(foo) AS foo BY sourcetype | where foo="bat" ]
index="_*" | eval foo="bat" | multireport [stats count first(foo) AS foo BY index | where foo="bar" ] [stats count first(foo) AS foo BY sourcetype | where foo="bat" ]
Great, this is working! Thanks Much!
Not sure why is messing the order of the fields in the stats... but is working.
Again, thanks much.