How to create a group for totals "greater than"?

[KyleMcDougall]

Hi all,

I've been working on this query for the last few days and still can't seem to crack it. (Appreciate the person from this forum that helped me get this far!)

I'm trying to create 2 groups: (1) Engaged, and (2) Not Engaged. The events are grouped by sessionId, which is a single conversation with a chatbot. A response from the bot or customer is an intent. So I'm trying to count sessionIds with 5 or more intents as Engaged.

Here's the idea, but obviously this query won't work since the bottom two eval commands are invalid. 

index=conversation botId=ccbd
| eval intent_count=if(like(intent,"%"), "1", "0")
| stats sum(intent_count) as intent_count by sessionId
| eval engaged=(where intent_count => 5)
| eval not_engaged(where intent_count <5)

Then, create a table that would look like this:

HEADER          TOTALS
Engaged            100
Not_engaged        100

[gcusello]

Hi @KyleMcDougall,

use eval and if, something like this:

index=conversation botId=ccbd
| eval intent_count=if(like(intent,"%"), "1", "0")
| stats sum(intent_count) as intent_count by sessionId
| eval status=if(intent_count => 5,"engaged", "not_engaged")
| stats count BY status

Please, take my approach and customize it to your needs.

Ciao.

Giuseppe