This seems like it should be rather simple, but I'm simply at a loss. All I'm trying to do is:
I can run the following searches independently without issue, but can't seem to figure out how to put them together.
All I really need to do is put them together so I can perform the calculation of "round((Compliant/Total),2) as CompliancePct"
The following is what I have so far, but it is interesting to note that the second query returns 28000+ when run alone and 0 in this combined query.
room="106" | stats count as Total | appendcols[| where S1_Temp>70 OR S1_Temp<76 | stats count as In]
Try something like this
room="106" | eval Compliant=if(S1_Temp>70 AND S1_Temp<76,1,0) | stats count as Total sum(Compliant) as Compliant | eval CompliancePct=round((Compliant/Total),2)
Try something like this
room="106" | eval Compliant=if(S1_Temp>70 AND S1_Temp<76,1,0) | stats count as Total sum(Compliant) as Compliant | eval CompliancePct=round((Compliant/Total),2)
I should have known the answer would involve 'eval'. I had played around with i t some, but was trying to combine it with the "where" instead of an "if". Thank you very much, that works perfectly and opened my eyes to a number of other possibilities.