Hi Splunkers,
I have built the following chart extracting hostnames from .csv files that have been exported from both associated databases:
Host DB1 DB2
PCA 1 1
PCB 0 1
PCC 1 1
PCD 0 1
...and so on.
A list of hostnames and then a 1 or 0 to indicate that it's listed in a particular database. What I am trying to do is figure out how to provide totals on how many are in each database. So lets say the reference database 2 has the full number of hostnames. Out of that number how many are also listed in database 1. Like Database1=568 and Database2=900.
Database1 and Database2 are currently listed as the /path/path/path/filename.csv source that the data sits in.
Thanks for any help!
Try this
your_search_here
| whatever_it_takes_to_get_that_chart
| addtotals
| stats count(eval(DB1==1)) as DB1_Total count(eval(DB2==1)) as DB2_Total count(eval(total==2)) as InBothDBs
Try this
your_search_here
| whatever_it_takes_to_get_that_chart
| addtotals
| stats count(eval(DB1==1)) as DB1_Total count(eval(DB2==1)) as DB2_Total count(eval(total==2)) as InBothDBs