Thanks in advance.
We are trying to sum two values based in the same common key between those two rows and for the ones missing a value should be considered as a cero, to be able to sum both fields (eval Count=Job_Count + Request_Count) .
Expected result should be:
PO_Ready Count
006341102527 5
011561102529 5
011971102529 6
012381102528 5
Hi rsokolova,
If you always have only one between Job_Count and Request_Count, you can try something like this:
your_search
| eval Count=coalesce(Job_Count,Request_Count)
| stats sum(Count) AS Count BY PO_Ready
otherwise if you have for a PO_Ready both Job_Count and Request_Count, you can try something like this:
your_search
| stats sum(Job_Count) AS Job_Count sum(Request_Count) As Request_Count BY PO_Ready
| eval Count=Job_Count + Request_Count
| table PO_Ready Count
Bye.
Giuseppe
Hi rsokolova,
If you always have only one between Job_Count and Request_Count, you can try something like this:
your_search
| eval Count=coalesce(Job_Count,Request_Count)
| stats sum(Count) AS Count BY PO_Ready
otherwise if you have for a PO_Ready both Job_Count and Request_Count, you can try something like this:
your_search
| stats sum(Job_Count) AS Job_Count sum(Request_Count) As Request_Count BY PO_Ready
| eval Count=Job_Count + Request_Count
| table PO_Ready Count
Bye.
Giuseppe
Thanks cusello for the quick reply the coalesce command did the trick.