How to question mark fields

[harishyhrk]

How to mark the fields with a question.

[niketn]

@harishyhrk, I am not sure if this was intentional, seems like you have wiped off your question with a new one but with only partial information. Requesting you to retain your original question here since answers have been provided with respect to the same. If the issue has been resolved, requesting you to accept the same as well.

Also, for a question on different lines, requesting you to post a new question.

[niketn]

@harishyhrk, if your current query is giving your Total_Time, Average and Minimum Columns for two Environments and you need it to be inversed, you should use the transpose command as the final pipe in your current query i.e.

  <YourCurrentSearch>
  | transpose header_field="Environment" column_name="Environment"

Following is a run anywhere search based on Splunk's _internal index. (PS: All data/stats is cooked up to generate some chart as per what you currently have).

index=_internal sourcetype=splunkd component!="ConfContentsCache" (log_level="WARN" OR log_level="ERROR")
| stats sum(date_second) as Total_Time avg(date_second) as Average min(date_second) as Minimum by log_level
| replace "ERROR" with "OpenShift" in log_level
| replace "WARN" with "Onpremises" in log_level
| rename log_level as Environment
| transpose header_field=Environment column_name=Environment

[somesoni2]

Actually I wanted to say non-stacked option (sorry about that). I create a runanywhere search to generate sample data as yours and use basic column chart for visualization and got this. Does it match what you need?

Search:

| gentimes start=-1 | eval temp="openpremisis#10.1111#8.2222#2.33333 openshift#12.4444#8.55555#2.66666" | table temp  | makemv temp | mvexpand temp | rename temp as _raw | rex "(?<Environment>.+)#(?<Total>.+)#(?<Average>.+)#(?<Minimum>.+)"  | table Environment Total Average Minimum

Output chart:

[somesoni2]

Try with column chart with stacked option (no Trellies)