I have some data with a field called "priority", which has a value from P1 -> P5.
this search query:
...
| stats count as Quantity by priority
produces a table that looks something like this:
priority | Quantity |
P2 | 1 |
P3 | 1 |
P4 | 6 |
P5 | 3 |
As you can see, there are no data entries with a priority of "P1". However, I would like to actually include that as a row in the table and show that there is a quantity of "0". Ideally I would want to include all 5 priority levels for any dataset, even when they are empty
Can anyone help and let me know how I can do this? Is there a way to specify which values to count?
...
| eval count=1
| append [| makeresults | eval priority=SPLIT("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority
Use below:
| append [| makeresults | eval priority=split("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority
...
| eval count=1
| append [| makeresults | eval priority=SPLIT("P1,P2,P3,P4,P5", ",") | mvexpand priority | eval count=0]
| stats sum(count) AS Quantity BY priority