This only means that your data set is not as you described. Alternatively, there was some mistake in your search as @ITWhisperer speculated. For example, maybe you misspelled A or B (these are not ...
See more...
This only means that your data set is not as you described. Alternatively, there was some mistake in your search as @ITWhisperer speculated. For example, maybe you misspelled A or B (these are not real field names I am certain). I can run my code with this mock dataset: A B StatusCode Upgrade 200 Downgrade 200 Upgrade 200 Retain 200 Cancel 200 Cancel 200 Cancel 200 Cancel 200 Cancel 200 Cancel 200 Cancel 200 Cancel 200 Retain 200 Retain 200 Retain 200 Retain 200 Retain 200 Retain 200 Retain 200 Retain 200 If you manually count, this dataset should give your mock result and it does. Here is full emulation that you can run an compare with real data: | makeresults format=csv data="StatusCode, A, B
200, Upgrade,
200, , Downgrade
200, , Upgrade
200, Retain,
200, , Cancel
200,Cancel,
200, , Cancel
200,Cancel,
200, , Cancel
200,Cancel,
200, , Cancel
200,Cancel,
200, , Retain
200, Retain,
200, Retain,
200, , Retain
200, Retain,
200, Retain,
200, , Retain
200, Retain,
200, Retain,
200, New Customer,
200, , New Customer
200, , New Customer
200, New Customer,
200, , New Customer"
``` the above emulates
index="XYZ" (ProxyPath="/xyz" OR ProxyPath="/abc") AND StatusCode=200
```
| eval "A OR B" = coalesce(A, B)
| stats count by "A OR B" StatusCode The output is exactly like your mock result: A OR B StatusCode count Cancel 200 8 Downgrade 200 1 New Customer 200 5 Retain 200 10 Upgrade 200 2