For me the below stats sum(count) by Asset_status provies no results .
eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats sum(count) by Asset_status
Asset_status sum(count)
Desktop
Others
Server
May i please know the reason for this and how can i get the sum of counts values.
stats sum(count) is not needed. just stats count is fine.
|stats count by Asset_status
eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status
stats sum(count) is not needed. just stats count is fine.
|stats count by Asset_status
eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status
Hi Umsundar, may i know if this issue got resolved, can you please mark it as accepted answer..
also, you can use case instead of a nested if
...|eval Asset_status= case(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server", Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop",1=1,"Others")|stats count by Asset_status