accountId: 12345678
action: Test
publishId: 123 or 456
tile: Tile1
How can I get this result: [accountID that has a tile=* value divided by the total number of total accountId's returned sorted by publishId 123 and 456 ]? Not all accountId's will have a tile value.
Try this -
your search that returns the events
| stats count(accountId) as CountAccounts count(tile) as CountTiles by publishId
| eval percent=round(100*CountTiles/CountAccounts,0)
Is CountTiles the total tile count...is that right? I'm looking for the number of accountId's that have tile= Not all accountId's have a tile value associated with it.
Also is there a way to just sort on the publishId so that I get only 2 results sorted by publishId? Again a wildcard.
i.e.
publishId="*123 and publishId=*456