How can I get a statistics table comparing discovered assets over time ?

[Ombessam]

Hello Guys,

I'm trying to get the following table:

I have the following fields in my index: ip, mac, lastdetect (timestamp) and user_id.

Below is what I have tried so far:

When I transpose I get the following:

I'm a bit stuck. Can anyone help me achieve my goal (getting a table similar to the first table just above) ? Thanks 

[Ombessam]

Thanks @ITWhisperer  for your quick answer addtotals will give the total of the 3 columns for each row while in this case only the total of last two columns are needed. Any workaround ?

Besides, transposing adds a new row in the top while I want the second row to be the first one (header) of the table. Any idea ? thanks

[ITWhisperer]

Use addtotals, the eval to subtract the first column?

[ITWhisperer · Accepted solution]

Have you tried using addtotals?

[Ombessam]

Thanks @ITWhisperer  I've used addtotals. Just one more thing left now how can I transform last  row Trend to become last column ?

[ITWhisperer]

What you are asking does make much sense - the sparkline is associated with the status (which is why it appears in the same column as the other stats related to each status. What is it that you are hoping to represent by making this a column?

[Ombessam]

@ITWhisperer  you're right. Thanks