tstats and inputlookup

[jeradb]

My current search is - 

| tstats count AS event_count WHERE index=* BY host, _time span=1h
| append [ | inputlookup Domain_Computers | fields cn, operatingSystem, operatingSystemVersion
| eval host = coalesce(host, cn)]
| fillnull value="0" total_events
| stats sparkline(sum(event_count)) AS event_count_sparkline sum(event_count) AS total_events BY host

How do I get operatingSystem to display in my table?   When I add it to the end of my search BY host, operatingSystem my stats break in the table.

[richgalloway · Accepted solution]

Add the operating system to the list of values returned by stats rather than as one of the group-by options.

| stats sparkline(sum(event_count)) AS event_count_sparkline sum(event_count) AS total_events, values(operatingSystem as operatingSystems BY host