Solved

stats aggregate output from conditional

Forum|Forum|11 months ago
January 10, 2025
4 replies
13 views

+1

golby
New Member

I have a value which if 0 is unsigned and anything else would be adhoc signed. I'm trying to do a count of these values, but when I do something like:

$flags = additional.fields["target.codesiging_flags"]
match:
    $flags
outcome:
    $type = array_distinct(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc"))
    $type_count = count(if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc"))

I get something the following output:

flags	type	type_count
0	unsigned	30
570556419	adhoc	10
512	adhoc	23
570425859	adhoc	500

Is there some way that I can combine the adhoc values so instead I get

flags	type	type_count
0	unsigned	30
570556419,512,570425859	adhoc	533

This way I can build visualizations off type and type_count.

Best answer by rajukg11

Please try this... this may be what you are looking for:

$type = if(additional.fields["target.codesiging_flags"] = "0", "unsigned", "adhoc")

match:

$type

outcome:

$type_count = count($type)

+6

rajukg11
Staff
Forum|Forum|11 months ago
January 10, 2025

If IIUC you are grouping by flags (match condition) hence the output will have each flag separately. Can't you group the type field in your visualizations so you can your desired output there?

If not, you have to think of a different match variable.

Like

G

+1

golby
Author
New Member
Forum|Forum|11 months ago
January 10, 2025

When I set Field of Data to type and value of data to type_count I sort of get what I want, but for example a pie chart will have multiple sections for all the adhoc types. Matching on flags has been the only way I can get both type and count for chart options.

If I don't set a match at all and do the following, I get the results that I'm looking for, but I'm unable to use it for the pie chart.

outcome:
    $adhoc = sum(if(additional.fields["target.codesiging_flags"] = "0", 0, 1))
    $unsigned = sum(if(additional.fields["target.codesiging_flags"] = "0", 1, 0))