Id=xyz
id=ABC
id=EDC
Id=FIS
index=* event=*| eval id = case(id = "xyz" , "one", id = "ABC", "Two")|eval index=case(index="work_prod","PROD",index="work_qa","QA")|table id, index, status |stats count(eval(status ="success")) AS Success, count(eval(status ="failure")) AS Failure BY id, index |rename index as Env, id as Application_name
I am using above query to get Application name and count of failures and success.
Result I am seeing:
Application_name Env Success Failure
one Prod 100 2
Two QA 20 10
I have more than 2 id's but since I am eval only two id's it is giving only two id's as output. How can I get the rest?
Expecting result:
Application_name Env Success Failure
one Prod 100 2
Two QA 20 10
EDC QA 20 10
FIS PROD 20 10
| eval id = case(id = "xyz" , "one", id = "ABC", "Two", true(), id)