I have the following output from my query:
**Search Query** | eval DateHour=year."-".month."-".day."-".hour | chart event_count BY DateHour, zone
DateHour | event_count | zone
2018-04-10 14 A
2018-04-10 14 B
2018-04-11 18 A
2018-04-11 18 B
What can I do to convert my table to something like this:
DateHour | A | B
2018-04-10 14 14
2018-04-11 18 18
Try this
<your_base_query_to_get_first_output>| chart values(event_count) over date_hour by zone
let me know if this helps!
| makeresults | eval DateHour="2018-04-10"
| eval event_count=14
| eval zone = "A"
| fields - _time
| append
[| makeresults | eval DateHour="2018-04-10"
| eval event_count=14
| eval zone = "B" | fields - _time ]
| append
[| makeresults | eval DateHour="2018-04-11"
| eval event_count=18
| eval zone = "A" | fields - _time ]
| append
[| makeresults | eval DateHour="2018-04-11"
| eval event_count=18
| eval zone = "B" | fields - _time ]
| chart values(event_count) over DateHour by zone
Try this
<your_base_query_to_get_first_output>| chart values(event_count) over date_hour by zone
let me know if this helps!
Are you sure you're using chart command like the one you showed (probably missing aggregate function)? If your chart command is ...| chart <<some aggregation>> BY DateHour zone
, then you should get the output#2 which you need. You're not using stats right?