Hello
I have a table with 7 columns, some of them calculated from lookup
I want to count the total of one of the columns and then calculate percentage of other column based on the total
I tried this but im getting 0 results
| stats count by SERVERS
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers
What can I do ?
Thanks
It is not clear what you are trying to achieve with your sample code.
The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?
The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?
Does this do what you want?
| eventstats count by SERVERS
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers
It is not clear what you are trying to achieve with your sample code.
The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?
The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?
Does this do what you want?
| eventstats count by SERVERS
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers