How to find the values of a field?

[mtrochym]

I am trying to find the total count of nodes in a pool, the total count of bad nodes in the pool AND, that part I am having an issue with, the VALUES of the names of the BAD nodes in the pool.

The below query returns the correct counts for total nodes in the pool and the correct count for total number of bad nodes but I am scratching my head on how to return the values of the NAMES of the bad nodes. All my attempts just return the names of ALL the nodes, when I just want the values of the names of nodes that are bad.

Any thoughts?
Thanks in advance.

| index= ...search blah blah...
| eval StatusOk=if(Status=="passing",1,0) 
| stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
| eval NodeOk = if(countStatusOk=totalCount,1,0) 
| eval NodeBad = if(countStatusOk=totalCount,0,1)
| stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes by server_type, environment 
| where countNodesBad > 0

[mtrochym]

That worked! Thank you!

[VatsalJagani]

Could you accept my answer for better reference to future visitors?

[VatsalJagani · Accepted solution]

Hello @mtrochym,

Please try this query:

| index= ...search blah blah...
 | eval StatusOk=if(Status=="passing",1,0) 
 | stats sum(StatusOk) as countStatusOk, count as totalCount by Node, server_type, environment  
 | eval NodeOk = if(countStatusOk=totalCount,1,0) 
 | eval NodeBad = if(countStatusOk=totalCount,0,1)
 | eval BadNode = if(NodeBad==1, Node, null())
 | stats sum(NodeOk) as countNodesOk, sum(NodeBad) as countNodesBad, count as totalNodes, values(BadNode) by server_type, environment 
 | where countNodesBad > 0

Hope this helps!!!