Sometimes I set myself SPL conundrum challenges just to see how to solve them. I realised I couldn't do something I thought would be quite straightforward. For the dummy data below I want a single ...
See more...
Sometimes I set myself SPL conundrum challenges just to see how to solve them. I realised I couldn't do something I thought would be quite straightforward. For the dummy data below I want a single row resultset which tells me how many events of each UpgradeStatus and how many events in total i.e. Total Completed Pending Processing 11 6 3 2 I don't know in advance what the different values of UpgradeStatus might be and I don't want to use addtotals (this is the challenge part). I came up with the solution below which kinda "misuses" xyseries (which I'm strangely proud of) . I feel like I'm missing a more straightforward solution, other than addtotals Anyone up for the challenge? Dummy data and solution (misusing xyseries) follows... | makeresults format=csv data="ServerName,UpgradeStatus
Server1,Completed
Server2,Completed
Server3,Completed
Server4,Completed
Server5,Completed
Server6,Completed
Server7,Pending
Server8,Pending
Server9,Pending
Server10,Processing
Server11,Processing"
| stats count by UpgradeStatus
| eventstats sum(count) as Total
| xyseries Total UpgradeStatus count