How to group by two months.

tabishritz — Mon, 02 Nov 2020 16:22:10 GMT

My query

"mwt-service" my query |stats count by channel service date_month

yields result like

channel	service	month	count
PBX	FNTF	november	4
STE	ACTR	november	5
PBX	FNTF	october	6
STE	ACTR	october	9

But I want to have two columns of each month count as below

channel	service	nov	oct
PBX	FNTF	4	5
STE	ACTR	3	8

please advice.

Re: How to group by two months.

ITWhisperer — Mon, 02 Nov 2020 16:39:36 GMT

| eval nov=if(month="november",count,null) | eval oct=if(month="october",count,null) | fields - month count | stats values(*) as * by channel, service

topic How to group by two months. in Splunk Search

How to group by two months.

Re: How to group by two months.