Eval If - count one item against sum total of the rest of the items in the group

[user93]

Hi,

So I a page with more than a few urls that represent that same page. However, one of these urls has a value that indicates it has a specific location that indicates promotion. I want to chart on a line graph both the promoted url and all urls that are not the promoted url.

I figure I have to use the eval if statement, but what I've done thus far is not working.

page=/store/product_abcd1234* -> note this returns many variants of the same page
|eval promostatus=if(page="/store/product_abcd1234?source=promoted, promo, nopromo)
|chart distinctcount(user) by promostatus

I want to count uniquely the number of users who had a referral from the promotion and the number of users who load the entire group of page values (except the promo). I'd like to chart this over time with both lines on the same time graph.

[to4kawa]

...
| rex field=page "source=(?<page_source>[^,&\?]+"
| eval page_source = if(page_source="promo", "promo", "nopromo")
| timechart usenull=f useother=f dc(user) by page_source

Selecting url, search these.