Something like | where match(X, "\b(SI|SB)\b")
| stats sum(SNO) as SNO_total Here is a full emulation | makeresults format=csv data="SNO, X
1,400
2, SI-SCRIPT-ERROR
3, (SI-BPR-01)
4, SB-Timeout
5,...
See more...
Something like | where match(X, "\b(SI|SB)\b")
| stats sum(SNO) as SNO_total Here is a full emulation | makeresults format=csv data="SNO, X
1,400
2, SI-SCRIPT-ERROR
3, (SI-BPR-01)
4, SB-Timeout
5, SB-OrderFound
6, (SB-BPR-02)--(SB-EXL-001)
7, 201
8, SI-RAS-200
9,"
``` data emulation above ```
| where match(X, "\b(SI|SB)\b")
| stats sum(SNO) as SNO_total Result is SNO_total 28