query : sourcetype=test | chart count by type, vendor | eval typewithvendor=type.":".vendor | fields typewithvendor, count, type
I want to show typewithvendor and count on chart and pass type value on drilldown. How to do this? Is it any way to do?
Any help would be appreciated.
@nishu... How about reversing your eval and chart command.
| eval type_with_vendor=type.":".vendor
| chart count by type, vendor
| sort - count