I am creating a dashboard which contains a query that returns application health events of this type:
Server |
Application |
Type |
Status |
|
servername |
appname |
App Health |
UP |
|
servername |
appname |
Disk Health |
UP |
|
servername |
appname |
LDAP Health |
UP |
|
servername |
appname |
Redis Health |
DOWN |
|
What I want instead is for the table to look like:
Server |
Application |
App Health |
Disk Health |
LDAP Health |
Redis Health |
servername |
appname |
UP |
UP |
UP |
DOWN |
What would be the best way to accomplish this?
Thank you for any suggestions.
You need to concatenate the server and application, the use xyseries, then split them again
| eval serverapp=server."|".application
| xyseries serverapp type status
| eval server=mvindex(split(serverapp,"|"),0)
| eval application=mvindex(split(serverapp,"|"),1)
| fields - serverapp
You need to concatenate the server and application, the use xyseries, then split them again
| eval serverapp=server."|".application
| xyseries serverapp type status
| eval server=mvindex(split(serverapp,"|"),0)
| eval application=mvindex(split(serverapp,"|"),1)
| fields - serverapp
Worked great. Thanks so much!