How to combine two fields with eval ?

[monipinni]

paymenttype RefunpaymentType

DEBIT DEBIT
GIFTCARD PGIFTCARD
ORIGINAL CREDITCARD
ORIGINAL DEBITCARD

I am trying to get output like this and also count of this combinations

Refund Count

DEBIT-DEBIT 100
GIFTCARD -PGIFTCARD 50
ORIGINAL-CREDITCARD 75
ORIGINAL-DEBITCARD 88

Can any one help

[siddharthkhatsu]

| search "body.refundTenderType"=*
| search "body.refundTenders{}.paymentType"=*
| rename body.refundTenderType as "RefundTender"
| rename body.refundTenders{}.paymentType as "RefundTenderPaymentType"
| stats count AS Count BY RefundTender RefundTenderPaymentType, body.orderNumber add this here
| eval Refund = RefundTender . "-" . RefundTenderPaymentType
| table Refund , body.orderNumber
| chart count by Refund

Try this if it works

[woodcock · Accepted solution]

Like this:

... | stats count AS Count BY paymenttype RefunpaymentType
| eval Refund = paymenttype . "-" . RefunpaymentType
| table Refund Count

[monipinni]

@woodcock : tried this search i got results but count is displaying is 1 instead of accurate count values

| search "body.refundTenderType"=* | search "body.refundTenders{}.paymentType"=* | rename body.refundTenderType as "RefundTender" | rename body.refundTenders{}.paymentType as "RefundTenderPaymentType" | stats count AS Count BY RefundTender RefundTenderPaymentType | eval Refund = RefundTender . "-" . RefundTenderPaymentType | table Refund , body.orderNumber | chart count by Refund

[woodcock]

1 extra step that is not in my answer; do this:

... | search "body.refundTenderType"=* AND "body.refundTenders{}.paymentType"=* 
| rename body.refundTenderType as "RefundTender", body.refundTenders{}.paymentType as "RefundTenderPaymentType" 
| stats count AS Count BY RefundTender RefundTenderPaymentType 
| eval Refund = RefundTender . "-" . RefundTenderPaymentType 
| table Refund Count

[mayurr98]

try this:

|  eval field=paymenttype+"-"+RefunpaymentType | stats count by field