Do math on two count_distinct results

Comments

2 comments

  • Avatar
    Vishal Choudhary

    Hi Matt,

    Thanks for your question and detailed explanation. Based on that I tried a similar query in-house. Here is the query for your reference:

    (((_sourceCategory=windows_events)))
    | parse "RecordNumber = *;" as recordnumber
    | parse "EventCode = *;" as eventcode
    | count_distinct(recordnumber) as totalrecords , count_distinct(eventcode) as totalevents
    | totalrecords + totalevents as Finalsum

    Similar to your query, I'm trying to calculate the distinct count of recordnumber, eventcodes & then adding them together in Finalsum. The above query gave me the following result:

    # totalrecords totalevents Finalsum
    1 520               58              578

    In order to get single value Finalsum as a result, I will add following line in my query:
    | fields Finalsum

    (((_sourceCategory=windows_events)))
    | parse "RecordNumber = *;" as recordnumber
    | parse "EventCode = *;" as eventcode
    | count_distinct(recordnumber) as totalrecords , count_distinct(eventcode) as totalevents
    | totalrecords + totalevents as Finalsum
    | fields Finalsum

    Output:
    #   Finalsum
    1   578

    Now, one can produce a single value dashboard for this. Hope this helps, here is the documentation on fields operator for your reference:

    https://help.sumologic.com/05Search/Search-Query-Language/Search-Operators/fields_operator

    Hope this helps. Let me know if I'm missing anything here.


    Regards,
    Vishal

    1
    Comment actions Permalink
  • Avatar
    Matt Wilson

    Thank you Vishal!

    This approach did work.  I am not sure why my first approach did not, my guess is that the parenthesis around the division was not acceptable for some reason.  

    0
    Comment actions Permalink

Please sign in to leave a comment.