How to use eval to fulfill the below requirement

[akashghonge]

Hi,
I am preparing a dashboard where i can show whether the devices are sending logs or not.
In some region device will send logs to 2 server and in some it will send only to 1 server.
Below is the sample file
1.1.1.1 UKPRI LogSending
2.2.2.2 UKPRI LogNotSending
3.3.3.3 UKPRI LogNotSending
1.1.1.1 UKSEC LogSending
2.2.2.2 UKSEC LogSending
3.3.3.3 UKSEC LogNotSending
4.4.4.4 USPRI LogSending
7.7.7.7 USPRI LogNotSending

Now i want the show which all devices are sending logs and which are not sending (Device 2.2.2.2 is sending log to primary and not sending to secondary, it should be show as sending logs) in stats form.

[woodcock]

Like this:

|makeresults|eval raw="1.1.1.1 UKPRI LogSending::2.2.2.2 UKPRI LogNotSending::3.3.3.3 UKPRI LogNotSending::1.1.1.1 UKSEC LogSending::2.2.2.2 UKSEC LogSending::3.3.3.3 UKSEC LogNotSending::4.4.4.4 USPRI LogSending::7.7.7.7 USPRI LogNotSending"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| fields - _time
| rex "^(?<host>\S+)\s+(?<destination>\S+)\s+(?<status>.*)$"

| rename COMMENT AS "Everything above generates event data; everything below is your solution"

| dedup destination host status
| sort 0 destination
| stats list(destination) AS destination list(status) AS status BY host

[cmerriman]

You could try something like:

|stats values(isSent) as isSent dc(server) as numServers by device |eval logSent=if(like(isSent,"%LogSending%"),1,0)

You might need to add |mvcombine isSent after the stats to make it one line.

isSent is the field name I used for LogSending, server for the server and device for device.