Status | Unit | Count |
Duplicate | IT | 5 |
Failure | BE | 2 |
Success | DE | 6 |
Success | IT | 25 |
Success | PT | 18 |
Success | DE | 10 |
Success | PT | 5 |
Total | 71 |
I am adding the col total using the query
| addcoltotals label=status lable =total
But now I want to calculate the sum by Unit Like this-
After calculating the sum want to create an alert if any of the unit is 0 then it will create an alert.
IT | 30 |
DE | 16 |
PT | 23 |
BE | 2 |
Total | 71 |
Try this
| stats sum(count) as total by unit
However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.
I want to do the total according to the status after calculating that I will check if the value is 0 for any unit It will create an alert
| stats sum(count) as total by unit
Using this it is not giving proper results .Do I have to remove addcolumns line.
Yes, remove the addcoltotals line or move it to after the stats, but you will need to change the column name as well.
Getting this table after using
|stats count as count by status Unit
Status | Unit | Count |
Duplicate | IT | 5 |
Failure | BE | 2 |
Success | DE | 6 |
Success | IT | 25 |
Success | PT | 18 |
Success | DE | 10 |
Success | PT | 5 |
But now I want it by the sum of unit according to the second table which given earlier.
| stats sum(count) as total by unit
This is not giving me the expected result.
Please show what you expect the result to be
I got it thanks
Try this
| stats sum(count) as total by unit
However, this will only give you totals greater than zero because there is nothing to add if there are no counts. If you want your alert to pick up on there being no values for a unit, you will have to append a row for each unit with a count of zero before this sum.