I want is a table that looks like this, but it seems like there is no simple way:
Field Count of sessions with the field Percent of sessions with the field
field_1 count_1 percent_1
field_2 count_2 percent_2
field_3 count_3 percent_3
This is the best way I have found to do it:
search (_field1_ OR _field2_ OR _field3_ OR _field_______that_______is_______in_______all_______sessions_) | stats dc(eval(if(field=_field1_, SessionID, NULL))) AS count1, dc(eval(if(field=_field2_, SessionID, NULL))) AS count2, dc(eval(if(field=_field1_, SessionID, NULL))) AS count3, dc(eval(if(field=_field_______that_______is_______in_______all_______sessions_, SessionID, NULL))) AS numberOfSessions | eval row=mvrange(1,4) | mvexpand row | eval Field=case(row=1,"field_______1", row=2,"field_______2", row=3,"field_______3") | eval Count=case(row=1,count1, row=2,count2, row=3,count3) | eval Percent=100*Count/numberOfSessions | table Field Count Percent
This works, but I feel like it is a pretty messy workaround and that there should be a better way. Also, I think using mvexpand makes it take longer. I could probably also do it with a transaction, but that also slows things down. I would like to just do dc(SessionID) by field, but then I can't get the total number of sessions into its own column to calculate the percentages.
... View more