Stats based on Case

[Jamie2Jamie]

I'm still new, and struggling with the following. I am looking at a set of data from three probes. If all three probes show success of "down" for the reporting period than I would like the result to be "down", but if one or more have a success of "up" than it should be considered "up" for that time span.

For instance:

12:00 - Probe1 - Up

12:00 - Probe2 - Down

12:00 - Probe3 - Up

13:00 - Probe1 - Down

13:00 - Probe2 - Down

13:00 - Probe2 - Down

So, for 12:00 the value would be Up, and for 13:00 the value would be down...

[richgalloway]

There's likely more than one way to do that.  Here's the first one I thought of.

Bucket the results by the hour and count the ones that are "down".  If that count is zero then make the result "down"; otherwise, make the result "up".

... | bin span=1h _time
| stats count(eval(success="down")) as downCount by _time
| eval result = if(downCount==3,"down","up")
| table _time result

If you want to know which probes are down then this variation should do it.

... | bin span=1h _time
| where success="down"
| stats values(success) as downProbes by _time
| eval result = if(mvcount(downProbes)==3,"down","up")
| table _time result downProbes