Hello,
I am having trouble with a simple search. I have the following data:
OBJECT ID,NEW STATE
1,STATE ONE
1,STATE TWO
1,STATE THREE
2,STATE ONE
2,STATE TWO
2,STATE ONE
3,STATE ONE
..and so forth
When i run below query, i'm getting count as 4.
index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT"
Now the issue is, when i tried to search for all values( 'NEW STATE'="*") , it gives me count as 0 instead of 7. This is the query i ran,
index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "*")) as "COUNT"
HI
If you want to count all event then index = "SAMPLE INDEX" | stats count('NEW STATE')) as "COUNT"
is batter.
If you are using dropdown in dashbard then below search will be useful to you.
Let say dropdown token = tokenDropdown
then search is:
index = "SAMPLE INDEX" | eval selectedValue="$tokenDropdown$", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"
If you select ALL (value=*) in dropdwn then search will be
index = "SAMPLE INDEX" | eval selectedValue="*", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"
If you select STATE ONE (value=STATE ONE) in dropdwn then search will be
index = "SAMPLE INDEX" | eval selectedValue="STATE ONE", NEW_STATE=if(selectedValue=="*",'NEW STATE',selectedValue) | stats count(eval('NEW STATE' = 'NEW_STATE')) as "COUNT"
Can you please try this??
Thanks
Your query is looking for 'NEW STATE' fields with the literal value "*". To count all values, remove the eval from the count.
index = "SAMPLE INDEX" | stats count('NEW STATE') as "COUNT"