Two problems with the search. In an evaluation function, deep path payload.status needs to be single quoted (i.e., 'payload.status') to dereference its value. Otherwise bare word payload.status ev...
See more...
Two problems with the search. In an evaluation function, deep path payload.status needs to be single quoted (i.e., 'payload.status') to dereference its value. Otherwise bare word payload.status evaluates to null. If you want to use count(is_ok), you should make the "other" value disappear, i.e., make it be a null, not a "real" value of 0. If you think 0 is a better representation for "other", use sum as @ITWhisperer suggests. In other words, on mock event sequence _raw payload.status seq {"seq":1,"payload":{"status":"ok"}} ok 1 {"seq":2,"payload":{"status":"degraded"}} degraded 2 {"seq":3,"payload":{"status":"ok"}} ok 3 either | eval is_ok=if('payload.status'=="ok", 1, null())
| stats count as total, count(is_ok) as ok_count or | eval is_ok=if('payload.status'=="ok", 1, 0)
| stats count as total, sum(is_ok) as ok_count or even | eval is_ok=if('payload.status'=="ok", 1, 0)
| stats count as total, count(eval(is_ok = 1)) as ok_count should give you total ok_count 3 2 This is an emulation you can play with and compare with real data | makeresults format=json data="[
{
\"seq\": 1,
\"payload\": {
\"status\": \"ok\",
}
},
{
\"seq\": 2,
\"payload\": {
\"status\": \"degraded\",
}
},
{
\"seq\": 3,
\"payload\": {
\"status\": \"ok\",
}
}
]"
| fields - payload, seq, _time
| spath
``` data emulation above ```