I have to bring 2 different numerical fields in one column name .I am fetching the fields from a view .
Example :I have fields like below ,
field 1 =Compliant_machines(which has count of compliant machines )
field2 =Non_Compliant_machines(which has count of compliant machines )
I have to bring this like below ,
Compliance | sum(Count ) |
Compliant_Machines | 123456 |
Non_Compliant_machines | 57421 |
I have acheived this using transpose ,but the drill down is not working using this transpose and stats .
I am used this code for drill down ,
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*" |stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as "Non Compliant"|transpose|rename column as "Compliance", "row 1" as "count"| search Compliance="Compliant"|table Acc_Name Acc_No Baseline form Rule " etc
The above code didnt work for me .Can someone help me to achieve this in drill down .
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*"
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant
|search Account_Environment="*" Acc_Name="*" Baseline="*" Rule="*"
|stats sum(Compliant_Tested) as Compliant sum(Noncompliant_Tested) as Non_Compliant by Acc_Name Acc_No Baseline form Rule
| eval Compliance=mvappend("Compliant_Machines","Non_Compliant_machines")
| mvexpand Compliance
| eval Count=if(Compliance="Compliant_Machines",Compliant,Non_Compliant)
| fields - Compliant, Non_Compliant