How to do stats count based on condition?

[csahoo]

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| stats count(eval(status="Received")) as received count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event

where as the
source : - is my application name
event :- Type of request whether synchronous request or Asynchronous request
labeltype : - Different type of label
sourcenodecode and geocode :- is the shopcode and shopregion from where the label is requested
received - no of label request received
failed - no of label request failed


Now i want to find the received and failed request count based on sourceNodeCode, geoCode, LabelType, event

But for failed request count i want to add condition -

in case of synchronous request or event the failed count should fetch from '*gps-request-processor-test*' application

in case of asynchronous request or event the failed count should fetch from "*gps-external-processor-test*" OR "*gps-artifact-processor-test*" application

The output should look something similar to this attached o/p.

[yuanliu]

So this is to add one more condition to the selection command I described in Re: Count based on condition. (If that original problem is solved, please mark an answer as solution.) All you need to do is to exclude Failed from the restrictive condition, i.e.,

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*"
 OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| where status!="Failed" OR (event == "Sync" AND source like "%gps-request-processor%" OR event == "Async")
 AND (source like "%gps-external-processor%" OR source like "%gps-artifact-processor%")
| stats count(eval(status="Failed")) as failed by sourceNodeCode geoCode LabelType event

[ITWhisperer]

Try something like this

index="*dockerlogs*" source="*gps-request-processor-test*" OR source="*gps-external-processor-test*" OR source="*gps-artifact-processor-test*" event="*Request"
| eval LabelType=coalesce(labelType, documentType)
| eval event = case (like(event,"%Sync%"),"Sync",like(event,"%Async%"),"Async")
| eval  failedevent=if(status="Failed" AND ((event="Sync" AND sourceNodeCode="gps-request-processor-test") OR (event="Async" AND (sourceNodeCode="gps-external-processor-test" OR sourceNodeCode="gps-artifact-processor-test"))), 1, 0)
| stats count(eval(status="Received")) as received sum(failedevent) as failed by sourceNodeCode geoCode LabelType event