Hello all,
I am using the follow string:
*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" | eval Percentage = round (100-(Over_Threshold/Total*100),2)
The results table then displays the columns I expect i.e. :
Over_Threshold , Total , Percentage
If I then try to add another (existing) field to the results using the following string:
*SEARCH TERM/MACROS HERE* | eval over = if (ttm_transaction_time>ttm_threshold, 1, 0) | stats sum(over) AS "Over_Threshold" count AS "Total" BY ttm_transaction_id | eval Percentage = round (100-(Over_Threshold/Total*100),2)
I am expecting the results to display:
Over_Threshold , Total , ttm_transaction_id, Percentage
But instead they display
Over_Threshold , Total , ttm_transaction_id
And seem to drop the Percentage column.
Can anybody give me advice as to why this is happening or how I can change it to present the four columns I want (and possibly more)?
I've now managed to solve this problem. Thanks for your guidance.
Care to say what you did/tweaked?
Does anybody else have any suggestions for this issue?
I've tried umpteen ways of re-ordering the commands but to no avail.
Sounds weird, I just try this search string similiarly, and it will generate four column as expected, but by default the count by field stands as the first column
The only time when eval is not going to create the result field is if any of the fields on the right hand side of the = are not present. How do your results if you remove the eval look like (the first few rows would suffice)?
Eval creates the Percentage field fine in the first example but not the second? Also, I have two eval commands, which are suggesting I remove?
I thought eval could create fields too?
Which eval should I try removing?