I need to write a query to find the sum of same field in same index but with different condition.

[nivethainspire_]

I have tried the below query,it works fine,but its complicated, Can anyone suggest a better way to write the same query,

index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer|fillnull value=blank "MS Bulletin" "Flags"|search OS="Windows" |stats sum(CVSS) as CVSS by "Asset Type"|join [search index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer |fillnull value=blank "MS Bulletin" "Flags"| search OS="Windows" "MS Bulletin"!=blank "Flags"=blank |stats sum(CVSS_E) as "OS Score" by "Asset Type"]|table "Asset Type",CVSS,"OS Score"

[sundareshr · Accepted solution]

Try this

index="vmt_sample" "Asset Type"=Desktop OR "Thin Client" OR Computer OS=Windows
| stats sum(CVSS) as CVSS sum(eval(if(isnotnull("MS Bulletin") AND isnull("Flags"), CVSS_E, 0)))  as "OS Score" by "Asset Type"
| table "Asset Type",CVSS,"OS Score"