Add Values from Rows

[dfrench151]

Hello,

I'm trying to add values from rows. See the picture below.

What I am pretty much trying to do is add the count from unconfirmed_down status to the up status. The thing is is that the unconfirmed_down status isn't always there depending on the source I am pulling from and could vary from month to month, so I need to have an exception included in case it is not there. I have though have saying add field 1 to field 2, but that could produce incorrect results if that particular status is not there...

[niketn · Accepted solution]

@dfrench151 can you try the following?

index=<yourIndexName>
| eval status=if(status=="unconfirmed_down","up",status)
| stats count by status

[dfrench151]

This only produced that status for up and count unfortunately

[niketn]

The above should move unconfirmed_down as up and remaining up and down status intact. So final sum should be only up and down status. Is your expectation different
?

[dfrench151]

Sorry about that. I re-ran that and it did what I needed. Thank you

[niketn]

No problem. Glad it worked!