I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like:
Search | Triggered | Scheduled | Test |
TestAlert1 |
True |
True | True |
Currently what I am getting is something like this:
Search | Triggered | Scheduled | Test |
TestAlert1 | True | False | False |
TestAlert1 | False | True | False |
TestAlert1 | False | False | True |
I am thinking I need to use xyseries chart but am not sure.
I assume that you are saying that if a search has True anywhere, then it's True, otherwise false.
You could do something like
| stats values(*) as * by Search
| foreach * [ eval <<FIELD>>=if(isnotnull(mvfind(<<FIELD>>, "True")), "True", "False") ]
but you could also set values to 1 and 0 for True/False and then do
| stats max(*) as * by Search
| foreach Triggered Scheduled Test [ eval <<FIELD>>=if(<<FIELD>>=1, "True", "False") ]