Hi,
I have scenario were i have the record sets and the number & name will keep changing based on the status
Table : No, Name,Status,Product,ID
Status can be (P-pending,C-cancelled, A-Accepted)
So, if i have to eliminate the duplicate should i use like this
-->index="XXXXX" PRODUCT=O1| dedup PCN |stats count(eval(STATUS="A")) AS APPROVED
or should I use latest ?
Thanks in advance.
Specifically, what do you want to count up?
If the status is only the number of A, you can do it.
index="XXXXX" PRODUCT=O1 STATUS="A"| dedup PCN |stats count AS APPROVED
Thank you @niketnaily @HiroshiSatoh @mayurr98
Status: A -Approved,C-Cancelled & P- Pending
Please find the mock table below and my requirement is to get the count of Approved records and the below will work
index="XXXXX" PRODUCT=O1 STATUS="A"|stats dc(PCN) AS APPROVED
or
index="XXXXX" PRODUCT=O1| dedup PCN |stats count(eval(STATUS="A")) AS APPROVED
PCN NameProduct ID Status
123 Varun 01 A
121 Arun 01 C
123 Varun 01 P
121 Arun 01 P
124 Don 01 D
124 Don 01 P
Hope i am not confusing.
do you want something like distinct count of PCN
where Status=A
?
Also, can you tell me what is PCN?
You can try something like this
index="XXXXX" PRODUCT=O1 STATUS="A"|stats dc(PCN) AS APPROVED
let me know if this helps!
@varunapj, I think what would help is, if you can post data sample of what you have and what is the output you want. You can mock/anonymize any sensitive information.
Specifically, what do you want to count up?
If the status is only the number of A, you can do it.
index="XXXXX" PRODUCT=O1 STATUS="A"| dedup PCN |stats count AS APPROVED