Need Solution for stats command

[rakesh_498115]

Hi i have my query something like this .

sourcetype="X" (some logic) |transaction keepevicted=true uniqueID |where duration>0 | stats count as Total | eval cond=(duration/60) | where cond < 30 | stats count as Passed | table Passed,Total

But i am not getting the results..

In the Total field i need the count of events that are below duration < 0

In the Passed field i need the count of events that are below duration < 0 and cond < 30

How can i get this ?? Please help...

[ziegfried · Accepted solution]

By doing stats count as Total you're removing all fields from the results stream, so there will be no duration fields you could use in the subpipeline. Probably more reasonable search:

sourcetype="X"  (some logic) | transaction keepevicted=true uniqueID | where duration>0 | eval passed=if(duration/60 < 30, "Yes","No") | stats count(eval(passed="Yes")) as Passed count as Total

or simpler

sourcetype="X"  (some logic) | transaction keepevicted=true uniqueID | where duration>0 | stats count(eval(duration/60 < 30)) as Passed count as Total