https://community.splunk.com/t5/Splunk-Search/Table-line-column/m-p/80028#M20237 <P>I don't understand your question, but I see a problem in your case statement:</P> <PRE><CODE>yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | chart count by series,day,hour </CODE></PRE> <P>I assume that day and hour are valid fields for all the events returned by the search? Are you sure that you want a chart and not a timechart? Here is a version that uses the timechart command instead:</P> <PRE><CODE>yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | timechart span=1h count by series </CODE></PRE> Wed, 20 Jun 2012 23:24:57 GMT lguinn2 2012-06-20T23:24:57Z https://community.splunk.com/t5/Splunk-Search/Table-line-column/m-p/80027#M20236 <P>Hello, <BR /> I created a search where I want to create a table including several cases.<BR /> My search include this: eval series=case(VE=7,'ok',VE=3,'ko',VE=2,'attempt') | chart count by series,day,hour.<BR /> I don t able to have the several case name in column and day and hour in line.</P> <P>Thx by advance<BR /> Laura</P> Wed, 20 Jun 2012 22:36:04 GMT https://community.splunk.com/t5/Splunk-Search/Table-line-column/m-p/80027#M20236 LauraBre 2012-06-20T22:36:04Z https://community.splunk.com/t5/Splunk-Search/Table-line-column/m-p/80028#M20237 <P>I don't understand your question, but I see a problem in your case statement:</P> <PRE><CODE>yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | chart count by series,day,hour </CODE></PRE> <P>I assume that day and hour are valid fields for all the events returned by the search? Are you sure that you want a chart and not a timechart? Here is a version that uses the timechart command instead:</P> <PRE><CODE>yoursearchhere | eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | timechart span=1h count by series </CODE></PRE> Wed, 20 Jun 2012 23:24:57 GMT https://community.splunk.com/t5/Splunk-Search/Table-line-column/m-p/80028#M20237 lguinn2 2012-06-20T23:24:57Z