HI all,
Could anyone help me to add another column which shows true/false based on values on the other 3 rows.
When all the three columns says "Not Patched" I want that row to be defined as False at the end of the table the same way when the three columns says "Patched" i want that to show as True. Below is my query.
index="oswinsec" sourcetype="windowsupdatelog" | search "*Patch Deployment*" AND "*AGENT_INSTALLING_SUCCEEDED*"
| rex field=_raw "^(?:[^:\n]*:){9}\s+(?P.+)"
| eval servers = Upper(mvindex(split(host,"."),-0))
| eval start=strptime(Time, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval month = Upper(date_month)
| replace "*KB*" WITH "Patched" IN ApplicablePatch
| stats values(count) as count values(ApplicablePatch) as ApplicablePatch by servers month | mvexpand servers
| chart values(ApplicablePatch) as InstalledPatch by servers | fillnull value="Not Patched"
@vinaykataaig,
Since the field names are dynamic for each month you run, try adding this to your current search
"your current search"|eval Result="True"
|foreach InstalledPatch* [eval Result=if(<<FIELD>>=="Not Patched","False",Result)]