help on tostring function

[jip31]

hello

I am doing the distinct count below in my search

| stats dc(host) AS OnlineCount by Code 
| where Code = "Online"
| fields OnlineCount 
| appendpipe 
    [ stats count 
    | where count=0]

But I also need to add text after the distinct count
So I am doing this after the distinct count but I have nothing

| eval dc = if(dc== 0, "no host", tostring(dc) + " hosts")

could you help me please??

[koshyk · Accepted solution]

I think you need to put name as "dc" , instead of variable OnlineCount
Also your code contains a NULL problem for "dc", so i've changed the last field to put value only if the dc >0

So

|makeresults
| eval hosts="myhost"
| eval Code="Online"
| fields hosts,Code
| stats dc(hosts) AS dc by Code 
 | where Code = "Online"
 | fields dc 
 | appendpipe 
     [ stats count 
     | where count=0]
 | eval dc = if(dc> 0, tostring(dc) + " hosts","no host")

[jip31]

Also thanks to you but I can accept only one answer...

[Sukisen1981]

There is no field named dc which you are executing your eval on, try this:
| stats dc(host) AS OnlineCount by info| eval OnlineCount = if(OnlineCount == 0, "no host", tostring(OnlineCount) + " hosts")
| fields OnlineCount

[jip31]

thanks a lot

[jip31]

ok thanks!
I forgotten "as onlinecount"......