Sum of particular field values

[Madhusri]

Hi,

Current table

Expected

fstatus	count
success	604
Userdefined	39

Need to sum the "password mismach","policy policy constraint violation","reset token expired","unexpected error setting password" and save it to as new value named "user defined" 

and need to rename the empty value in fstatus field to success.

Anyone please help on this.

Regards,

Madhusri R

[gcusello]

Hi @Madhusri,

you have to create an eval command to define the fstatus of your transactions, something like this:

index=your_index
| eval status=if(fstatus="password mismach" OR fstatus="policy policy constraint violation" OR fstatus="reset token expired" OR fstatus="unexpected error setting password","user defined","success")
| stats count BY status

Ciao.

Giuseppe

[PickleRick]

"Prettier" solution probably could be made using a lookul translating from one set of codes into another set of categories.

But even with a simple eval, instead of a multi-or-ed conditon I'd rather use a case statement - that's a bit more flexible and easy to maintain IMHO.