Archive

How to create the below view?

Path Finder

I have a below query:

index="autoprodcmcomparisions" sourcetype="autoproddetailslog" source="/logs/web/output/iwarranty/" "/apps/web/sfw/java/" | search NOT Server_Name=wb* | chart values(JavaVersion) over JavaVersion by Server_Name

The above query view shows as below

JavaVersion -------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172

jdk170
151--------------..............................jdk170151................................... jdk170151

jdk170171.............. jdk170171 ........................................jdk170_171

I want the view to be as below,how to do that?

JavaVersion -----------------------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172
jdk170
151 jdk170171-----------jdk170171--------jdk170151------------jdk170171-----jdk170_151

Tags (1)
0 Karma

Champion

Do you want to display on a single line?

(your search)|stats values(*) as *
0 Karma

Path Finder

@HiroshiSatoh,

The above worked, but now the ordering of columns have changed with Java_Version column now came at the middle. Of what I y=understand after the command "|stats values(*) as *" it has arranged the columns alphabetically. How to rearrange it back to the previous order?

0 Karma

Ultra Champion

You can use the | table field1,field2,... command to order the fields as you desire.

0 Karma

Path Finder

@HiroshiSatoh

yes I need in a single line. Above query works for the servers and not under the java_version

0 Karma

Ultra Champion

What exactly do you mean that it doesn't work for the Java_Version field? You mean the multiple values in the field are displayed below each other? That's because it is a multi valued field.

You can combine that into a single value by using | eval Java_Version = mvjoin(Java_Version, " ")

0 Karma