Hello,
I'm trying to add values from rows. See the picture below.
What I am pretty much trying to do is add the count from unconfirmed_down status to the up status. The thing is is that the unconfirmed_down status isn't always there depending on the source I am pulling from and could vary from month to month, so I need to have an exception included in case it is not there. I have though have saying add field 1 to field 2, but that could produce incorrect results if that particular status is not there...
@dfrench151 can you try the following?
index=<yourIndexName>
| eval status=if(status=="unconfirmed_down","up",status)
| stats count by status
@dfrench151 can you try the following?
index=<yourIndexName>
| eval status=if(status=="unconfirmed_down","up",status)
| stats count by status
This only produced that status for up and count unfortunately
The above should move unconfirmed_down as up and remaining up and down status intact. So final sum should be only up and down status. Is your expectation different
?
Sorry about that. I re-ran that and it did what I needed. Thank you
No problem. Glad it worked!