Hello, I've been researching this online for over a day and nothing seems to be working for me. I have 2 EVAL IF statements that simply looks at the network.connectType field. | eval MOBILE=if(n...
See more...
Hello, I've been researching this online for over a day and nothing seems to be working for me. I have 2 EVAL IF statements that simply looks at the network.connectType field. | eval MOBILE=if(network.connectType="MOBILE","1","0") | eval WIFI=if(network.connectType="WIFI","1","0") I am in need of creating a table that would show the count of MOBILE, WIFI, TOTAL, by Branch. i.e Branch | Total | WIFI | MOBILE I'm able to create the table, but the two evals always show the same counts as the Total count. I can't figure out why I am doing wrong. The search I am using is the following: index=main "details.package"="com.siteone.mobilepro", "details.tag"="Connectivity Service", event=NoConnectivityEvent, "details.message.additionalInfo.NetworkAccessStatus"="None" | fields network.connectType, event, userSettings.site | eval MOBILE=if(network.connectType="MOBILE","1","0") | eval WIFI=if(network.connectType="WIFI","1","0") | stats values("userSettings.site") as Branch, count(event) as "Total Disconnects", count(MOBILE) as "Cellular Disconnects", count(WIFI) as "Wifi Disconnects" by "userSettings.site" | table Branch, "Total Disconnects", "Wifi Disconnects", "Cellular Disconnects" Any help on this would be awesome and much appreciated. Thanks