After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.
e.g. (just an example of syntax)
base search | chart count over "Survey Month" by "Survey Type" | eval "a"='a'*20 | where 'b'<'a' | stats sum("b") as "B" by "a"
You should just be able to use a
and b
but if you need it to be oriented differently, then you can switch from using chart
to using stats
or you could use the untable
command to do the same thing.
After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.
e.g. (just an example of syntax)
base search | chart count over "Survey Month" by "Survey Type" | eval "a"='a'*20 | where 'b'<'a' | stats sum("b") as "B" by "a"
Thanks a ton! This helps!
@monyathomas If your problem is resolved, please accept the answer to help future readers.
Can you provide some sample data and a more clear idea of what calculations you are looking to do after the initial chart command?