index=$index$ sourcetype=$sourcetype$ $string1$
.
.
| fillnull value=FALSE
| stats
count(email) AS TOTAL
count(eval(authenticated="TRUE")) AS auth_count
count(eval(cancelled="TRUE")) AS cancelled_count
count(eval(promoted="TRUE")) AS PROVISIONED
| eval AUTH_DROP_OUT=TOTAL-auth_count
| eval USER_CANCELLED=auth_count-cancelled_count
| eval LOGIN_DROP_OUT=TOTAL-AUTH_DROP_OUT-USER_CANCELLED-PROVISIONED
| table TOTAL,AUTH_DROP_OUT,LOGIN_DROP_OUT,USER_CANCELLED,PROVISIONED
| transpose
| rename column AS ActionTaken "row "1 AS Count
| eval ActionTaken=ActionTaken." : ".Count
↧