Trying to figure out how to aggregate with top when there are two field choices.
Here's an example of what I am trying:
Basically I have events that have either field1 OR field2. The events that have field1 also have a field called event1_type, the events that have field2 have a field called event2_type.
So I have the following search: (field1 > 5 OR field2 = 1). This works great. Normally if I was doing a single field search I would then '| top event_type'. Since the events have one of two event_type choices I'm not sure how to aggregate with top the event{1,2}_type values.
Any help is much appreciated.
Scott
I guess I would consider eval
ing a new field using coalesce()
:
field1 > 5 OR field2 = 1 | eval e_type=coalesce(event1_type,event2_type) | top e_type
If you're before 4.1, coalesce(x,y)
is just if(isnotnull(x),x,y)
.
I guess I would consider eval
ing a new field using coalesce()
:
field1 > 5 OR field2 = 1 | eval e_type=coalesce(event1_type,event2_type) | top e_type
If you're before 4.1, coalesce(x,y)
is just if(isnotnull(x),x,y)
.
Thanks! That worked perfectly!