How to display only one value in column?

[aa0]

Hi,

I'm trying to display only a value in one particular column, for instance represent one team for different status. This is what I've done so far:

index=xxx | stats count by Team, status

*my expecting result is to have only one "DevOps" to represent team for different status displayed.

Team        |     Status         | Count

DevOps     Assigned           10

                      Pending              5

                      New                      2

                      Resolved            1

                        ..........

Many thanks for any help 🙂

[matt8679 · Accepted solution]

You could try something like this:

index=xxx | stats count by Team, status
|eval field="status=" .status. "  ".  "count=" .count
|stats values(field) as stats by Team

[aa0]

Thanks Matt!!!

[gcusello]

hi @aa0,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @aa0,

it isn't possible!

It's possible (but it's quite long to implement) to have something like this:

Team        |     Status         | Count
DevOps     
                 Assigned           10
                 Pending             5
                 New                 2
                 Resolved            1

 Ciao.

Giuseppe

[aa0]

So what will be the possible query to begin with?