Hi There,
we have a search which covers multiple values as below (each field has a single value)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
I wanted to add two extra results to the same search, but this time the field has two values
for example: if we want count of a field "Processed", it has two cases
case1: Processed=true
case1: Processed=false
How to count these by true or false and show in the same table as above?
Please help.
| eval processedTrue=if(Processed,true,null())
| eval processedFalse=if(Processed,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed
Thanks @ITWhisperer but not sure if am missing something, I get the below error:
Error in 'eval' command: The arguments to the 'if' function are invalid.
I assumed the field Processed was already boolean. Try:
| eval processedTrue=if(Processed=true,true,null())
| eval processedFalse=if(Processed=true,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed
| eval processedTrue=if(Processed,true,null())
| eval processedFalse=if(Processed,null(),true)
| chart
count(serviceName) as total
avg(totalFrontendLatency) as elapsetime
max(totalFrontendLatency) as maxelapsetime
count(processedTrue) as ProcessedOK
count(processedFalse) as NotProcessed