.. | chart count(eval(Status="Success" OR ServiceName="B" AND ErrorCode=102)) as "Success", count(eval(Status="Error" OR ServiceNameLookup="B" AND ErrorCode!=102)) as "Fail" by ServiceName
This query counting 102 for both sucess & falures.
Any suggetions for both please
UPDATE (or rather a complete rewrite)
It's too late in this TZ to do any clever thinking. Forget the previous attempt, and do like this instead;
... | eval NewStat = if(errorcode=="102" AND service=="B", "success", status) | ...
This creates a temporary variable called NewStat
in each event, which will be set to 'success' if the errorcode=102 and the service=B, for all other events it will just copy the value of 'status'.
Then you can use NewStat
for any further reporting, such as;
... | chart c over service by NewStat
Hope this helps,
Kristian
see update above. tested and working. /k
Sorry, Kristian. That did't work. 😞 tried in several ways