I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and...
See more...
I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and not by domain.
| chart count(event_id) as Count by Domain
A 4 B 7 C 2 D 5 A, B 2 A, D 4 C, B 3 A, D, B 6
I want to display outages that effect each domain. So anything that includes A (A; A,B; A,D; A,D,B) will be added and the count for A will be 16. Same for the other domains.
The end result should be: A 16 B 18 C 5 D 15
I've tried eval domain=if(domain=A OR domain="A, B" OR domain="A, D" OR domain="A, D, B", "A", domain) ....... but that only works for the first one. The combined domains aren't included in the totals for the subsequent if statements.