Need to add a separator in Stats table between each Sort

[arunsubram]

----| stats sparkline as magnitude_trend,count by rest_api_name,http_status_code,a | lookup AppIdLookUp a OUTPUT PartnerName | sort PartnerName

Above is my query to do refer a lookup file and populate the PartnerName. Currently I have about 100+ PartnerNames and each Partner has 5 to 10 rest api names. My stats table look like big grid.

For easy reading, I wanted to add a colored space row or separator after each PartnerName sorted like below

restname1 statuscode-400 count PartnerA
restname2 statuscode-400 count PartnerA
restname3 statuscode-400 count PartnerA

restname1 statuscode-400 count PartnerB
restname2 statuscode-500 count PartnerB
restname3 statuscode-401 count PartnerB

restname1 statuscode-200 count PartnerC
restname2 statuscode-400 count PartnerC
restname3 statuscode-500 count PartnerC

Appreciate any suggestions

[martin_mueller · Accepted solution]

To generate the row itself, you could do something like this:

... | stats ... | lookup ... | appendpipe [stats count by PartnerName | fields - count | eval rest_api_name="ZZZ make sure this causes the row to sort towards the end"] | sort PartnerName rest_api_name | eval rest_api_name=case(NOT match(rest_api_name, "^ZZZ"), rest_api_name)

That should insert a row per partner, set the rest name to some placeholder to be sorted towards the end, do the sort, hide the placeholder.

Colouring the separator row can be done with a bit of JS and CSS in dashboards.