Sum of count conditionally within a query

[dcavag001c]

I have incoming calls and I'm trying to get total number of calls followed by sum of calls where the field "result" equals declined, caller_ended, or callee_ended. I'm able to get the sum(count) but for the second part I am only getting a count of the events when really I want to sum the count.

How can I get a sum of the field count where result is equal to "callee_ended", "caller_ended" or "declined" without filtering the first part of the query

|stats sum(count) as NumberofCalls , sum(eval(if((result = "declined" OR result = "caller_ended" OR result = "callee_ended"), count, NULL))) AS SuccessfulCalls

[somesoni2 · Accepted solution]

Try like this

your base search | eval successcalls=if(result = "declined" OR result = "caller_ended" OR result = "callee_ended",count,null()) | stats sum(count) as NumberofCalls, sum(successcalls) as SuccessfulCalls

[dcavag001c]

Thanks for your response but that still only returns the count of events with those parameters rather than a sum(count) with those parameters.

[somesoni2]

That should've worked, I've setting the value of successcall to count when your result value follows those condition. Could you post the query that you tried, possibly full query?

[dcavag001c]

Sorry about that. The query I was using to check the count was incorrect. Your query works! Sorry for the confusion.