I have the following search used to gather data which is used later in a hiddenpostprocess search :
index=blah | stats count by Product_Group, Application, Severity, _time
My postprocessing seach is :
stats sum(count) AS Count by Product_Group Severity
Which outputs the data in a multiline per product format.
Product_Group Severity Count
A Major 1
B Major 1
C Major 6
C Minor 1
D Minor 2
E Minor 1
F Critical 92
F Major 117
3 columns. Product_group Severity and count.
I would like to format the data like this.
Product_Group Critical Major Minor
A 0 1 0
B 0 1 0
C 0 6 1
D 0 0 2
E 0 0 1
F 92 117 0
Prior to using postprocessing a search that would provides the format I want would be :
stats sum(eval(Severity="Critical")) AS Critical, sum(eval(Severity="Major")) AS Major, sum(eval(Severity="Minor")) AS Minor by Product_Group | sort - num(Critical)
Is it possible to use an eval within a stats sum(count)?
Anytime I try to do an eval inside that I get zero values.
edit #1: Tried using a chart command
| stats sum(count) AS Count by Product_Group Severity | chart Count over Product_Group by Severity
But it is not fed the correct data so its wrong (but right visual format however!).
i was close with my first edit.
The solution for those playing at home.
chart sum(count) AS Count over Product_Group by Severity
So simple facepalm.
View solution in original post