So I have the columns "Values" and "Status" and I only want to count Values where the status is zero. How can I do this?
here is my search:
source="*\\XML\\Example_Result\\Event_meter.xml" | table EventID EventName Value Status | join type=left EventID [search source="*\\XML\\Example_Result\\Event_map.xml" | where EventType="Transaction" | table EventID EventName] | where EventID!=-1 | chart count(Value where status!=0) AS PASS, count(Value where status=0) AS FAIL by EventID
Thanks!
You want to use the following construction:
chart count(eval(status!=0)) as PASS count(eval(status=0)) as FAIL
(Question: Why the join
? You already have EventName
in the main search.)
Hi,
Try, if you want to count only the values where status is 0, you can do this:
source="XMLExample_ResultEvent_meter.xml" | table EventID EventName Value Status | join type=left EventID [search source="XMLExample_ResultEvent_map.xml" | where EventType="Transaction" | table EventID EventName] | where EventID!=-1 OR status==0 |chart count(Value) AS PASS by EventID
You want to use the following construction:
chart count(eval(status!=0)) as PASS count(eval(status=0)) as FAIL
(Question: Why the join
? You already have EventName
in the main search.)