how to get Stats sum of field with latest correlationId?

[karthi2809]

Hi All,

Below query to get stats sum of field values of latest correlationId. need to show in pie chart. But i am getting values as other.PFA screenshot

 index="mulesoft" *Upcoming Executions* content.scheduleDetails.lastRunTime="*"
[search index="mulesoft"  *Upcoming Executions*   environment=DEV | stats latest(correlationId) as correlationId | table correlationId|format]|rename content.scheduleDetails.lastRunTime as LastRunTimeCount | stats count(eval(LastRunTimeCount!="NA")) as LastRunTime_Count  count(eval(LastRunTimeCount=="NA")) as NA_Count by correlationId| stats   sum(LastRunTime_Count) as LastRunTime_Count,sum(NA_Count) as NA_Count

[yuanliu]

Your last stats command outputs two columns LastRunTime_Count and NA_Count.  Pie chart can only use one column.  Can you illustrate your intentions with column output and describe how a pie chart can depict both?

[karthi2809]

Hi @yuanliu 

Thanks, how can we club the both into one to show count based on the two conditions

[yuanliu]

---

Thanks, how can we club the both into one to show count based on the two conditions

---

What do you mean "based on the two conditions?"  Your original question simply says 

to show in pie chart. But i am getting values as other

---

The answer to this is: You cannot have a pie chart with two columns.  If you "getting values as other" is not the problem, what is?  Illustrate your data - in text (anonymize as needed), illustrate desired result - normally I'd say in text but in this case, a mockup graphic piechart could work, then, explain the logic to derive the desired results from illustrated data in plain language without SPL.  These are three essential ingredients of an answerable question.