How do I count the number of events based on the value of a field is *

[maniu1609]

Hello,

I am having trouble with a simple search. I have the following data:

OBJECT ID,NEW STATE
1,STATE ONE
1,STATE TWO
1,STATE THREE
2,STATE ONE
2,STATE TWO
2,STATE ONE
3,STATE ONE

..and so forth

When i run below query, i'm getting count as 4.

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT"

Now the issue is, when i tried to search for all values( 'NEW STATE'="*") , it gives me count as 0 instead of 7. This is the query i ran,

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "*")) as "COUNT"

[kamlesh_vaghela]

HI

If you want to count all event then index = "SAMPLE INDEX" | stats count('NEW STATE')) as "COUNT" is batter.

If you are using dropdown in dashbard then below search will be useful to you.
Let say dropdown token = tokenDropdown then search is:

index = "SAMPLE INDEX" | eval selectedValue="$tokenDropdown$", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

If you select ALL (value=*) in dropdwn then search will be

index = "SAMPLE INDEX" | eval selectedValue="*", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

If you select STATE ONE (value=STATE ONE) in dropdwn then search will be

index = "SAMPLE INDEX" | eval selectedValue="STATE ONE", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"

Can you please try this??

Thanks

[richgalloway]

Your query is looking for 'NEW STATE' fields with the literal value "*". To count all values, remove the eval from the count.

index = "SAMPLE INDEX" | stats count('NEW STATE') as "COUNT"