hi
From the code below, I need to do a pie chart with 2 labels
I am doing a first count in order to count the events | where NOT (Building_AP = Building_IT)
My question is simple
How to display a second label in the pie chart which count the totality of the events less the events | where NOT (Building_AP = Building_IT) ?
It means that i need a label which count the % of events | where NOT (Building_AP = Building_IT) and another label which count the % of the remaining events
`test`
[| inputlookup host.csv
| table host
| rename host as USERNAME ]
| lookup YY.csv NAME as AP_NAME OUTPUT Building
| lookup XX.csv HOSTNAME as USERNAME output BUILDING_CODE
| eval Building=upper(Building)
| stats last(Building) as Building_AP, last(BUILDING_CODE) as Building_IT by USERNAME
| where NOT (Building_AP = Building_IT) AND isnotnull(Building_IT)
| stats count as APnotITOP
Thanks for your help
↧