I have simple table as shown below
I want to be able to add a new row which takes the count of "Completed Stage 1" and subtracts the count of "Hit Quit" and subtracts the count of "Completed Stage 2" to give me another row like this:
How can I achieve this? I tried several combinations including this, but I can't get the result I want:
eval NetError = count("Completed Stage 1") - count("Hit Quit") - count("Completed Stage 2") | rename NetError as "Assumed Network Error"
Thanks
Hi,
Give this a go:
your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count
Regards,
Javier
Give this a try
your current search giving above table
| appendpipe [| eval temp=1 | chart sum(Count) over temp by Msg |eval Msg="Assumed Network Error" | eval Count== 'Completed Stage 1' -'Hit Quit'-'Completed Stage 2' | table Msg Count ]
I gave this a try and it didn't work. Instead of my table I was getting a page that looked like all the events with many fields
Hi,
Give this a go:
your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count
Regards,
Javier
Thanks I got this working nice and easily