Distinct count of one field when second field matches string %200%

[praveenvemuri]

Hi I am trying two get distinct count of field1 when field2 contains string 200, 500, 400 etc and i am trying to summary index it. i cannot dedup it before eval function as same field1 value can exist in for another response

eval response=case(rsppcode LIKE "%200%", 200,     rsppcode LIKE "%401%", 401, 
                   rsppcode LIKE "%403%", 403,     rsppcode LIKE "%404%", 404, 
                   rsppcode LIKE "%409%", 409,    rsppcode LIKE "%504%", 504, 
                   rsppcode LIKE "%500%", 500,     rsppcode LIKE "%422%", 422,
                   rsppcode LIKE "%550%", 550,    rsppcode LIKE "%", Others ) 
| timechart span=5min dc(field1) by response

tried this one but when summaryindexed. it was unable to recognise response field as it is eval field. all response count is under null.

Normal output

_time                       200  401    403 404 409 422 500 504 NULL
1   4/8/13 9:40:00.000 AM   2151    2   9   87              9   108
2   4/8/13 9:45:00.000 AM   2746    10  17  333 4   2       41  862
3   4/8/13 9:50:00.000 AM   2770    11  17  359     2       49  827

output from summaryindex

time nulll
somevalue somevalue

Please advise..

[lguinn2]

Try this - put the values for response in quotes

eval response=case(rsppcode LIKE "%200%", "200",     rsppcode LIKE "%401%", "401", 
                   rsppcode LIKE "%403%", "403",     rsppcode LIKE "%404%", "404", 
                   rsppcode LIKE "%409%", "409",    rsppcode LIKE "%504%", "504", 
                   rsppcode LIKE "%500%", "500",     rsppcode LIKE "%422%", "422",
                   rsppcode LIKE "%550%", "550",    rsppcode LIKE "%", "Others" ) 
| timechart span=5min dc(field1) by response

I also recommend that you use sitimechart instead of timechart for summary indexing. Look here for more info

Finally, I am not sure how the title of this post relates to the question - am I missing something?