Hi,
I have multiple fields like, counting how many items passing through gates:
| timechart count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building
I want to exclude the counts of items_RG from the all_items, so I'm using :
| eval Total=all_items-items_RG
But it is not showing Total in the output, but when I use stats instead, I don't get the time column to show the graph as timechart.
| stats count(eval(like(gate_id, "RG%") )) as items_RG, count(eval(NOT like(gate_id, "RG%") )) as all_items by building
| eval Total=all_items-items_RG
I tried to use eventstats also couldn't get what I want.
... View more