I need to count the total based on status, but also the number of sessions for each status. The number of sessions is the distinct count of the sessionId field.
| makeresults 1 | eval status="FAILURE", sessionId=2345
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="SUCCESS", sessionId=1234]
| stats count AS Total, dc(case(match(status, "FAILURE"), sessionId)) as "TotalSessions" by status
this gives me
Status, Total, TotalSessions
FAILURE, 4, 0
SUCCESS, 1, 0
but it needs to be
Status, Total, TotalSessions
FAILURE, 4, 2
SUCCESS, 1, 1
What am i doing incorrectly?
-Chris
Hi Chris,
Try this
| makeresults 1 | eval status="FAILURE", sessionId=2345
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="SUCCESS", sessionId=1234]
| stats count AS Total, dc(sessionId) as "TotalSessions" by status
All the best
Edit: sorry updated
Hi Chris,
Try this
| makeresults 1 | eval status="FAILURE", sessionId=2345
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="FAILURE", sessionId=1234]
| append [| makeresults 1 | eval status="SUCCESS", sessionId=1234]
| stats count AS Total, dc(sessionId) as "TotalSessions" by status
All the best
Edit: sorry updated
ah, I was over-thinking it. Long day. It works. thanks!