Skip to main content

I have a value which if 0 is unsigned and anything else would be adhoc signed. I'm trying to do a count of these values, but when I do something like:

 

$flags = additional.fields["target.codesiging_flags"]
match:
$flags
outcome:
$type = array_distinct(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc"))
$type_count = count(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc"))

 

 I get something the following output:

flagstypetype_count
0unsigned30
570556419adhoc10
512adhoc23
570425859adhoc500

Is there some way that I can combine the adhoc values so instead I get 

flagstypetype_count
0unsigned30
570556419,512,570425859adhoc533

This way I can build visualizations off type and type_count.

If IIUC you are grouping by flags (match condition) hence the output will have each flag separately.  Can't you group the type field in your visualizations so you can your desired output there?


If not, you have to think of a different match variable.

When I set Field of Data to type and value of data to type_count I sort of get what I want, but for example a pie chart will have multiple sections for all the adhoc types. Matching on flags has been the only way I can get both type and count for chart options.

If I don't set a match at all and do the following, I get the results that I'm looking for, but I'm unable to use it for the pie chart. 

outcome:
$adhoc = sum(if(additional.fields["target.codesiging_flags"] = "0", 0, 1))
$unsigned = sum(if(additional.fields["target.codesiging_flags"] = "0", 1, 0))

 

Please try this... this may be what you are looking for:


 



$type = if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc")

match:

   $type

outcome:

$type_count = count($type)

Thanks! That was it. Appreciate the help!

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.