I am using the follow search to generate a pie chart,
and I want toadd the score to the label on the pie chart.
say Math_total_score -> "Math 8 score".
But as my stats is not using by some_filed.
I find that I cannot use eval to change the label.
May someone help?
myLogSearch| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score| transpose
Change the as Math_total_score
in your stats
to as the_label_you_want
.
Final eval should look like the following: (You can use cascaded replace command to find string patterns and replace with what you want in a column.
<Your Base Search>
| eval column=replace(replace(replace(column,"Math_total_score","Math"),"English_countable_score","English"),"Phy_countable_score","Phy")
You need to use a conditional eval.
myLogSearch
| stats count(eval(like(subject,"Maths"))) as Math_total_score, count(eval(like(subject, "English") AND attended == true )) as English_countable_score, count(eval(like(subject, "Phy") AND times >2 )) as Phy_countable_score
| transpose
| eval column = if(column="Math_total_score", "Math", column)
Change the as Math_total_score
in your stats
to as the_label_you_want
.
Add this after the transpose: | eval column = column . " (" . 'row 1' . ")"
Thanks, it work perfectly!
really sorry that I forget to say that I want to add the count(eval(like(subject,"Maths"))) to the label....
I have updated the question