Hi Everyone,
This might be straight forward and I'm missing it but my current query is below and I am not able to get the correct results, any thoughts? End goals is to get all with status of Done and a Resolution of blank.
| eval done_null = if(Status="Done" AND Resoloution!="*",Score,"0")
| stats sum(done_null) as Done_Null by time
| table time, Done_Null
Score is not number, I guess. check field extraction.
hi @to4kawa Score is another field in my data set. It comprises of numbers from 0-10
sample:
| makeresults count=100
| eval time=strftime(_time,"%c")
| eval Score=random() % 11
| eval Status=mvindex(split("Done,Running",","),(random() % 3)), Resoloution=if(Score % 2 = 1,NULL,"High")
| eval done_null = if(Status="Done" AND Resoloution!="*",Score,"0")
| stats sum(done_null) as Done_Null by time
| table time, Done_Null
check these feilds(time,Status,Resoloution)
@to4kawa So, I get that you created a random sample of numbers for my column Score and incorporated, but then I got lost at your example using mvindex. So let's say that is Status is 'Done' and Resolution is blank, I want it to return a 1, and then if not return a zero. How would you change this example to make it work properly.
| eval done_null = if(Status="Done" AND Resoloution!="*","1","0")
| stats sum(done_null) as Done_Null by time
| table time, Done_Null
As not working your query, some of your fields(time ,Score ,Resoloution) is wrong or nothing.
I don't know your whole query. I can't see or resolve your problem.
Have you checked these? try line by line?
> but then I got lost at your example using mvindex.
please see the command reference.