How can I edit my stats search to change the output format?

[ulikabbq]

I have a formating question.

When I run this:

index=userdata | eval platform=case(rl_user_agent like "%iPhone%", "Mobile" ,rl_user_agent like "%iPad%", "Mobile" , rl_user_agent like "%Android%", "Mobile" , 1=1, "Full Site") | eval status=case(rl_user_status=="Guest", "Guest", rl_user_status like "%Active%", "Active Sub", 1=1, "Registered") |rex field=rl_path "[/](?<path_root>[^/]*)"  | eval path_root=upper(path_root) | table status path_root platform | stats count by status path_root platform | stats list(platform) AS Platform, list(count) AS count by status path_root

I get

status : path_root : Platform : count
status1   path1      full site   12
                     mobile      10
status1   path2      full site   12
                     mobile      10

but how can I get

status : path_root : full site : mobile
status1  path1        12         10

status1  path2        12         10

[fdi01]

try like this:

...| chart count(eval(Platform="full site")) AS "full site",
count(eval(Platform="mobile ")) AS mobile  by status path_root

or

...| stats  count(eval(Platform="full site")) AS "full site" count(eval(Platform="mobile ")) AS mobile  by status path_root

[Runals]

Try chart instead of stats

... | chart count over path_root by Platform

Might have to reverse your over/by fields in the chart command; I generally get those reversed.

You will likely have to do an eval to concatenate status and path and then rex to split them out though. There might be a better option presented by someone else as well.

[ulikabbq]

this is getting me much closer