Transpose Row Total
is there a way to create a dynamic column within transpose operator that will provide say, a row total? I am not sure what the _fieldname is that the transpose operator uses for its data...
-
Not a simple solution but the following should work. | count src_ip, state | if (!isNull(state), 1, 0) as tmp | total tmp as total_state by src_ip | fields - tmp | transpose row src_ip, total_state column state Basically what were doing is creating a numeric field which represents a classification exists for each set of IP and classifications that came back from the initial count operation. | if (!isNull(state), 1, 0) as tmp We can then use the "Total" operator on this new field to get the total number of classifications by our IP. | total tmp as total_state by src_ip This total can then be provided as part of the -row-statement of the transpose operation to show a column with that total value. | transpose row src_ip, total_state column state Hope this works for you.
Please sign in to leave a comment.
Comments
1 comment