| tstats count from datamodel=~~ where Field1="A" by B, C
| eval Addition = B + C
When I run above query, all values of additional fields are blank(not B+C)
I want to extract those(B and C) values
| eval Addition = count
is possible
AND
It's also possible in a regular search(not tstats).
But only in tstats
with fields except count and _time, it is impossible to show values.
How do you make this?
ps.
I wanna make
Field1-------------------------Field2------------------NewField--------------count
aaa----------------------------AAA---------------------aaaAAA----------------44
bbb----------------------------BBB---------------------bbbBBB----------------57
ccc----------------------------CCC---------------------cccCCC----------------10
from
Field1-------------------------Field2------------------count
aaa----------------------------AAA---------------------44
bbb----------------------------BBB---------------------57
ccc----------------------------CCC---------------------10
@apple143
Try:
| eval Addition = B.C
Smaple:
| makeresults | eval Field1="aaa",Field2="AAA" | eval NewField=Field1.Field2
@apple143
Try:
| eval Addition = B.C
Smaple:
| makeresults | eval Field1="aaa",Field2="AAA" | eval NewField=Field1.Field2
oh I got it
it was not problem of "tstats"
When I tried to extract values from the column, the column name contained "." character.
I think it made error.
I used rename and change field name without "." character.
After then, It worked.
Thank you
I aleady tried that
It works in standard search.
It doesn't work when I used "tstats" search
Can you share output?
| tstats count from datamodel=~~ where Field1="A" by B, C
| table Addition B C
?
Are B and C has simple field name. if not then try it rename it,
eg.
node1.field1 as B
node1.field2 as C