How to group different values and count the number of transactions?

[auaave]

Hi guys,

I have 2 data sources (source 1 and source 2) with different locations and transactions.
How can I group the locations to Inbound and Outbound and count the transactions?

Thank you.

Source 1
Location        Transaction
Location/dock/1     ok
Location/rec/1      ok
Location/pack/1     ok
Location/ship/1     ok


Source 2
Location        Transaction
Location/dock/1     not ok
Location/rec/1      not ok
Location/pack/1     not ok
Location/ship/1     not ok

Groupings
Inbound = Location/dock/1 , Location/rec/1  
Outbound = Location/pack/1, Location/ship/1

Result
Location       Ok   not ok
Inbound     2          2
Outbound        2          2

[kamlesh_vaghela · Accepted solution]

Hi @auaave ,
Can you please try this?

YOUR_SEARCH | | eval Location=case(like(Location,"%dock%") OR like(Location,"%rec%"),"Inbound",like(Location,"%pack%") OR like(Location,"%ship%"),"Outbound") | chart count over Location by  Transaction

My Sample Search:

| makeresults | eval Location="Location/dock/1,Location/rec/1,Location/pack/1,Location/ship/1" | eval Location=split(Location,",")| mvexpand Location | eval Transaction="ok" | append [| makeresults | eval Location="Location/dock/1,Location/rec/1,Location/pack/1,Location/ship/1" | eval Location=split(Location,",")| mvexpand Location | eval Transaction="not ok"] | eval Location=case(like(Location,"%dock%") OR like(Location,"%rec%"),"Inbound",like(Location,"%pack%") OR like(Location,"%ship%"),"Outbound") | chart count over Location by  Transaction

Thanks

[auaave]

@kamlesh_vaghela, thanks for your help! The groupings works well but I changed the last part to take into account the 2 types of sources.