help for doing a pie chart from 2 subsearch

[jip31]

hi

I have the search below

`test` 
    [| inputlookup host.csv 
    | table host 
    | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| stats last(Building) as BuildingAP, last(BUILDING_DESCRIPTION) as BuildingIT 

What I need is to do a pie chart in order to have the percentage of the events where BuildingAP doesnt match with BuildingIT
So first, I have to write this where condition
After I need to count the number of events corresponding to this where condition and to count also the total number of events (events without the where condition) in order to have 2 news fields which allows doing a pie chart
but pearhaps there is another solution?
For summarize I need a pie chart with 2 label in %, one which calculate the % of events where BuildingAP is not equal to BuildingIT and another which is the equal tio the total % of events - the % the previous count
Is anybody cant help me please??

[jip31]

Ii there somebody for helping me please??

[jip31]

Is anybody has an idea please??

[gcusello]

Hi jip31,
Try something like this:

`test` 
 [ | inputlookup host.csv 
   | table host 
   | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| search NOT (Building = BUILDING_DESCRIPTION)
| stats count 

Bye.
Giuseppe

[jip31]

Hi
I have no results (pie empty only....)

[diogofgm · Accepted solution]

Try something like this and change according to what you are trying to compare:

 `test` 
     [| inputlookup host.csv 
     | table host 
     | rename host as USERNAME ] 
| lookup aps.csv NAME as AP_NAME OUTPUT Building  
| lookup cmdb.csv HOSTNAME as USERNAME output BUILDING_DESCRIPTION
| eval isEqual = case(Building = BUILDING_DESCRIPTION,"true","false")
| stats count by isEqual 

[jip31]

Hi
it doesnt works
I have the message " Error in 'eval' command: The arguments to the 'case' function are invalid."

[diogofgm]

can you try again? there was a typo on the case arguments (missing ")