Display a pie from different values summing some of them

[canyavall]

Hi All, I need to show a pie for failed and succeed values, we know those values from the field "type" but 3 of them would be considered failed and 1 succeed

This is the current search:
type="bootup.bootupFailed" OR type="ForcedPortalReload" OR type="ClassLoadingFailed" OR type="allWidgetsInitializedAndLoaded" | stats dc(devRef) count by type

Of course this one is showing me a pie with all 4... but I need the pie to show only succeed and failed
failed -> type="bootup.bootupFailed" OR type="ForcedPortalReload" OR type="ClassLoadingFailed"
succeed -> type="allWidgetsInitializedAndLoaded"

How can I do it?

[richgalloway · Accepted solution]

Try this

type="bootup.bootupFailed" OR type="ForcedPortalReload" OR type="ClassLoadingFailed" OR type="allWidgetsInitializedAndLoaded" 
| eval type = case(type=="allWidgetsInitializedAndLoaded", "succeed", 1==1, "failed")
| stats dc(devRef) count by type

[canyavall]

Awesome, thank you very much!!!

I already checked the command case for eval, now I understand it, thank you!!