Hi
I have a single which shows the total assets after a search.
I then want to add a token so that i can use the result of that search to add it a label, to show value /$value$
so: index="123" | search field="abc " AS foo | count(foo) AS $tkn_bar$ | [search index="456" | search field2="def" AS new | count(new) AS new | fields new
So the single would show: new
Then in the label it would be: / $tot_bar$ which would really be "/ foo.count"
So the final single would display: new / foo.count
Try this
index="456" | search field2="def" AS new | count(new) AS new | appendcols [search index="123" | search field="abc " AS foo | count(foo) as temp] | eval final=new."/".temp | fields final
Try this
index="456" | search field2="def" AS new | count(new) AS new | appendcols [search index="123" | search field="abc " AS foo | count(foo) as temp] | eval final=new."/".temp | fields final
Perfect cheers