My Aim : This below query gives me count of success, failure by b_key, c_key. I want to get the distinct count of b_key for which the failure occurred. In the example below it will be 2.
| eval Complete = case(key_a="complete", "Complete")
| eval Init = case(key_a="init" , "Init")
| stats count(Init) as Init, count(Complete) as Complete by b_key, c_key
| eval Fcount = if((Init != Complete),1,0)
| eval Scount = if((Init = Complete),1,0)
| stats sum(Fcount) as FailureCount, sum(Scount) as SuccessCount
| eval total=(FailureCount+SuccessCount)
| eval Success% = round(SuccessCount/total*100,2)
| eval Failure% = round(FailureCount/total*100,2)
| table FailureCount, SuccessCount, Success%, Failure%
... View more