I need to see which questions a user answered. It is a multiple value field. Possible values:
question="1" or question="1,3" or question="" ....
I want to create a chart. My search is:
makemv delim="," question| mvexpand question| eval question= case(question==1, "Question-1", question==2,"Question-2", question==3,"Question-3",question=="","Not Filled") | chart count by question
But it doesn't show the results for empty string ""
value. Does anybody know a way to do that?
Cheers!
I think that where the value is gone.
|makemv delim="," question| mvexpand question
Try this!
|eval question=if(question=="",",",question)|makemv allowempty=true delim="," question| mvexpand question|
I think that where the value is gone.
|makemv delim="," question| mvexpand question
Try this!
|eval question=if(question=="",",",question)|makemv allowempty=true delim="," question| mvexpand question|
Thanks! "eval if" was the key point to solve the problem.
The final query that works:
|eval question=if(question=="","Not Filled",question) |makemv allowempty=true delim="," question| mvexpand question | eval question= case(question==1, "Question-1", question==2,"Question-2", question==3,"Question-3",question=="Not Filled","Not Filled") | chart count by question