Compare resp code count of two dates for each servername

[indeed_2000]

Hi 

I have query that return count of different resp codes of servers for 2 days

now need to find different between these two days.

current output:

Respcodes    Srv1      Srv2       Srv3       Srv4  ….

200                    80           10          100       42

400                    12           55            11         0

500                     11           34             2          8

…

expected output:

Date.                  Respcodes    Srv1      Srv2       Srv3       Srv4  ….

2024/02/23  200                    80           10          100       42

2024/02/24  200                    70           19            11        11

2024/02/23  400                    12           55            11         0

2024/02/24  400                    44           14            46         89

2024/02/23   500                    11           34             2          8

2024/02/24   500                     11           34             2          9              

…

if there is delta that calculate count of each server for two dates will be great!

any idea?

thanks

[ITWhisperer]

Your current output doesn't have any dates, so where are these going to come from?

Please provide some sample events?

Also, please provide your current search, so we can see how you are currently processing the events?

[indeed_2000]

@ITWhisperer Here is the current query, and when i add _time in xyseries it will show resp ode as columns instead row::

index="myindex" 
| rex field=source "\/.*\/log\.(?<servername>\w+)."
| rex "R(?<Respcode>\[\d+\]\[\d+\])" | bin _time span=1d

| stats count as Respcode_count by Respcode,servername,_time

| xyseries Respcode ,servername,Respcode_count

Current output:

Respcodes    Srv1      Srv2       Srv3       Srv4  ….

200                    80           10          100       42

400                    12           55            11         0

500                     11           34             2          8

…

expected output:

Date.                  Respcodes    Srv1      Srv2       Srv3       Srv4  ….

2024/02/23  200                    80           10          100       42

2024/02/24  200                    70           19            11        11

2024/02/23  400                    12           55            11         0

2024/02/24  400                    44           14            46         89

2024/02/23   500                    11           34             2          8

2024/02/24   500                     11           34             2          9              

…

any idea?

[ITWhisperer · Accepted solution]

You can only use three fields for xyseries, the x-axis, the y-axis and the series (names) - hence the name of the command! It is similar in that respect to the chart command. Try something like this

index="myindex" 
| rex field=source "\/.*\/log\.(?<servername>\w+)."
| rex "R(?<Respcode>\[\d+\]\[\d+\])" | bin _time span=1d

| stats count as Respcode_count by Respcode,servername,_time

| eval {servername} = Respcode_count
| fields - servername Respcode_count
| stats values(*) as * by _time Respcode
| fillnull value=0

[indeed_2000]

@ITWhisperer thanks work perfectly.

is there any way to show resp count numbers like this: 10,1K, 2M, …?