Hi,
I'm building a chart of customers and what operating system they're using:
chart count(_raw) by customer,ua_platform | sort ua_platform - "WinXP"
ua_platform can be "WinXP","Win7","MacOSX", etc...
I'm sorting that chart by WinXP descending. I want to limit results to only those customers where the count of WInXP is > 0. Basically I need to report on all our customers using XP, but if they're using other platforms, I need that data too (so I can't just search for ua_platform=WinXP and then where > 0). Any suggestions?
Thanks,
Rob
Try this
your base search | chart count(_raw) by customer,ua_platform | fillnull value=0 | sort ua_platform - "WinXP" | where WinXP > 0
Try this
your base search | chart count(_raw) by customer,ua_platform | fillnull value=0 | sort ua_platform - "WinXP" | where WinXP > 0
Worked exactly as described. Thanks!