team12 sum1
atgbc.im 10
bctgd.im 20
cdtgb.im 30
abrfc.in 40
bcded.in 50
total (.im) 60
total (.in) 90
total(in+im)150
Fields names are "name" and "sum"."Team12" is the name of the list having all (.in and .im files)
We have to figure out how to calculate total(.im) and total(.in)?
You would use appendpipe
command like this:
your current search giving field name and sum
| appendpipe [| where like(name,"%.im") | eval name="total (.im)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"%.in") | eval name="total (.in)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"total%") | eval name="total all" | stats sum(sum) as sum by name]
You would use appendpipe
command like this:
your current search giving field name and sum
| appendpipe [| where like(name,"%.im") | eval name="total (.im)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"%.in") | eval name="total (.in)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"total%") | eval name="total all" | stats sum(sum) as sum by name]
THE CODE YOU HAVE WRITTEN IS CORRECT AND IT IS WORKING FINE.
I will extend this problem, Suppose we have a drop-down in dashboard having three option,1- total all,2-total-(.im) 3- total-(.in).So if we select option -1 then It should display all the individual team ,total(im),total(in),total.
if we select option -2 then it should display only (.im) teams and total(.im) and similarly if we select 3 option,it should display all (.in) team and total(.in).
Can we implement this using only one search?
I have used three search for that but want to implement it using only one.
You can. Your dropdown token value should be
1. *
for option 1 - total all
2. *(im)*
for option 2- 2-total-(.im)
3. *(in)*
for option 2- 2-total-(.in)
And your search should be this
your current search giving field name and sum
| appendpipe [| where like(name,"%.im") | eval name="total (.im)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"%.in") | eval name="total (.in)" | stats sum(sum) as sum by name]
| appendpipe [| where like(name,"total%") | eval name="total all" | stats sum(sum) as sum by name]
| search name="$DropdownTokenName$"
Yeah ,It is working fine.
Thanks