I want to add two columns to a table which add up the number of times the word "TRUE" and "FALSE" occur in a row (which means, per host).
Example:
Host | HasA | HasB | HasC | HasD |NumTRUE|NumFALSE|
Server1 | TRUE | TRUE | TRUE | TRUE | 4 | 0 |
Server2 |FALSE | TRUE | TRUE | TRUE | 3 | 1 |
Server3 | TRUE |FALSE | TRUE | TRUE | 3 | 1 |
Server4 | TRUE |FALSE | TRUE |FALSE | 2 | 2 |
Server5 |FALSE |FALSE |FALSE | TRUE | 3 | 1 |
I tried something like
| eventstats sum(eval(if(Has*="TRUE"),1,0)) AS NumTRUE count(eval(if(Has*="FALSE"),1,0)) AS NumFALSE
but that didn't work out.
Try like this
your current search giving fields Host and Has* fields
| replace "TRUE" with 1 in Has* | addtotals label="NumTRUE" | replace "1" with "TRUE" in Has*
| replace "FALSE" with 1 in Has* | addtotals label="NumFalse" | replace "1" with "False" in Has*
Alternatively
your current search giving fields Host and Has* fields | untable Host key value
| appendpipe [stats count by Host value | replace "TRUE" with "NumTRUE" "FALSE" with "NumFalse" in value | rename value as key | rename count as value]
| xyseries Host key value | table Host Has* NumTRUE NumFALSE