Stats count for multiple fields in search

[rockybhai]

I have a query that has multiple states represented in each log event how do i get stats based on the state values my logs look like this 

event 1 : x=true, y=true, z=false

event 2 : x=false, y=false, z=true

event 3: x=true, y= false, z=true

i want track all the scenarios where the values are true for these stages(x, y, z) like.

base_search AND (x=true or y=true or z=true) | stats count by x, y, z

state	count
x	2
y	1
z	2

Is this possible to chart or do i have to log each state individually ? 

[bowesmana]

Here's an example - the first part sets up your dataset, then shows how to use stats.

| makeresults
| eval _raw="x,y,z
true,true,false
false,false,true
true,false,true"
| multikv forceheader=1
| table x y z
| stats sum(eval(if(x="true",1,0))) as x sum(eval(if(y="true",1,0))) as y sum(eval(if(z="true",1,0))) as z
| transpose 0 column_name="state" 
| rename "row 1" as count

Hope this helps

[rockybhai]

Each log statement contains only one reference to x,y,z. In your example i see you have loaded all the various states into one string. This will be represented as three messages in my case.

_raw;"setup x=true, y=false, z=false"
_raw: "setup x=true, y=true, z=false"

so when i search for setup i can get all these logs but not sure how to table these values.

[bowesmana]

The example shows 3 events, this is the part that sets up exactly the data you posted in your original post

| makeresults
| eval _raw="x,y,z
true,true,false
false,false,true
true,false,true"
| multikv forceheader=1
| table x y z

 and if you run this on its own, you get 3 events, as you posted.

So, the part you need is the stats part