I have a tag which has four values i.e. a,b,x,y. But I want to display only the x and y values as the top value. I tried the below query but it is not working.
Source title=webatm* | eval t=if(tag==x OR tag==y)|top t
Try:
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t
Inside an if
(or other eval
function), an un-quoted string represents a field name, and a quoted string represents the string itself.
Or, for multivalue fields, try:
| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t
Try:
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t
Inside an if
(or other eval
function), an un-quoted string represents a field name, and a quoted string represents the string itself.
Or, for multivalue fields, try:
| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
| top t
Hi micahkemp,
The above query is including all the values a,b,x,y and not x,y only.
It's returning same as below query.
Source type=webatm*|top tag
I want only x and y values.
It doesn't when I run it:
| makeresults count=6| eval tag="x"
| append [| makeresults count=10 | eval tag="y"]
| append [| makeresults count=20 | eval tag="z"]
| eval t=if(tag="x" OR tag="y", tag, NULL)|top t
Is your tag value a multivalue field, perhaps, where one event has multiple values for tag? If that is the case try this instead:
| eval t=mvfilter(match(tag, "x") OR match(tag, "y"))
|top t
Thanks Micahkemp.
It was anmultivalue field and the mvfilter is working.
Appreciated your help.Thanks a ton
Great! I've added the mvfilter version to my answer. If that answer solves your issue, please accept it so the question no longer appears open, and others have an easier time finding the answer.
It still shows the percentage among all the values i.e. a,b,x,y and not between x and y only.
The above query result shows the same as below query
Source type=webatm* |top tag
But this is including all a,b,x and y values which I don't want.