How to table results with multiple evals?

[aohls]

I have a search where I have multiple evals to check if items are true of false. With my results I want to show something like:

Search	Triggered	Scheduled	Test
TestAlert1	True	True	True

Currently what I am getting is something like this:

Search	Triggered	Scheduled	Test
TestAlert1	True	False	False
TestAlert1	False	True	False
TestAlert1	False	False	True

I am thinking I need to use xyseries chart but am not sure.

[bowesmana]

I assume that you are saying that if a search has True anywhere, then it's True, otherwise false.

You could do something like

| stats values(*) as * by Search
| foreach * [ eval <<FIELD>>=if(isnotnull(mvfind(<<FIELD>>, "True")), "True", "False") ]

but you could also set values to 1 and 0 for True/False and then do

| stats max(*) as * by Search
| foreach Triggered	Scheduled Test [ eval <<FIELD>>=if(<<FIELD>>=1, "True", "False") ]