how to: count(Values) where status=0

[deanilol]

So I have the columns "Values" and "Status" and I only want to count Values where the status is zero. How can I do this?

here is my search:

source="*\\XML\\Example_Result\\Event_meter.xml" | table EventID EventName Value Status | join type=left EventID [search source="*\\XML\\Example_Result\\Event_map.xml" | where  EventType="Transaction" | table EventID EventName] | where EventID!=-1 | chart count(Value where status!=0) AS PASS, count(Value where status=0) AS FAIL by EventID

Thanks!

[ngatchasandra]

Hi,
Try, if you want to count only the values where status is 0, you can do this:

source="XMLExample_ResultEvent_meter.xml" | table EventID EventName Value Status | join type=left EventID [search source="XMLExample_ResultEvent_map.xml" | where EventType="Transaction" | table EventID EventName] | where EventID!=-1 OR  status==0 |chart count(Value) AS PASS  by EventID

[aweitzman · Accepted solution]

You want to use the following construction:

chart count(eval(status!=0)) as PASS count(eval(status=0)) as FAIL

(Question: Why the join? You already have EventName in the main search.)