I want to add a column "FinalType" in a statistical table, so when the EventType=ScoreLock and TxnType=Renewal, it should show the value "Scorelock" in the FinalType column. The results should look like this:
EventType TxnType FinalType
ScoreLock Renewal ScoreLock
Bind Endorsement Exception
Renewal Offer Renewal EUBI
I am currently using this search to display these results:
index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType
How about this
index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType | eval FinalType=case(eventType="ScoreLock" AND transactionType="Renewal","ScoreLock",eventType="Bind" AND transactionType="Endorsement","Exception",1=1,"EUBI")
How about this
index="np_dpa" sit-api-monitor EventType="[request]" OR EventType="[error]" PROXYNAME="mpgw_RecordUBIVehicleScore"|stats count by eventType transactionType | eval FinalType=case(eventType="ScoreLock" AND transactionType="Renewal","ScoreLock",eventType="Bind" AND transactionType="Endorsement","Exception",1=1,"EUBI")