I have the following search
index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | stats count by source, status
It gives me 4 rows with the fields source, status and a count for each, since the status can be either OK or ERROR
How can i turn this into a pie chart that shows a slice fore each source by status
Will answer this my self.
I just did
index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | chart count by source, status
Will answer this my self.
I just did
index="surveillance-status" source="rest://drip status" OR source="rest://drip-status2" | chart count by source, status