Transpose Row Total

Comments

1 comment

  • Avatar
    Kevin Keech
    Not a simple solution but the following should work. | count src_ip, state | if (!isNull(state), 1, 0) as tmp | total tmp as total_state by src_ip | fields - tmp | transpose row src_ip, total_state column state Basically what were doing is creating a numeric field which represents a classification exists for each set of IP and classifications that came back from the initial count operation. | if (!isNull(state), 1, 0) as tmp We can then use the "Total" operator on this new field to get the total number of classifications by our IP. | total tmp as total_state by src_ip This total can then be provided as part of the -row-statement of the transpose operation to show a column with that total value. | transpose row src_ip, total_state column state Hope this works for you.
    0
    Comment actions Permalink

Please sign in to leave a comment.