Hi,
I have datas with these fields (this is a sample)
Project : Splunky
Label : Integration
Month : January
Project : Splunky
Label : Preproduction
Month : January
Project : Splunky
Label : Production
Month : April
Project : Mail
Label : Production
Month : February
Project : Share
Label : Integration
Month : March
Project : Share
Label : Production
Month : June
I want to print the results by Project by Month group by label
Is it possible?
Thanks
This sets up the sample data:
| makeresults
| eval raw="Project : Splunky, Label : Integration, Month : January::Project : Splunky, Label : Preproduction, Month : January::Project : Splunky, Label : Production, Month : April::Project : Mail, Label : Production, Month : February::Project : Share, Label : Integration, Month : March::Project : Share, Label : Production, Month : June"
| makemv delim="::" raw
| mvexpand raw
| rename raw AS _raw
| rex "Project\s*:\s*(?<Project>[^,]+),\s*Label\s*:\s*(?<Label>[^,]+),\s*Month\s*:\s*(?<Month>.*)"
This does the work that you need:
| eval _time = strptime(Month . "/1", "%b/%d")
| sort 0 _time
| streamstats dc(_time) AS _serial
| eval Month = case((_serial==1), Month,
(_serial==2), " " . Month,
(_serial==3), " " . Month,
(_serial==4), " " . Month,
(_serial==5), " " . Month,
(_serial==6), " " . Month,
(_serial==7), " " . Month,
(_serial==8), " " . Month,
(_serial==9), " " . Month,
(_serial==10), " " . Month,
(_serial==11), " " . Month,
(_serial==12), " " . Month,
(_serial==13), " " . Month)
| chart values(Label) OVER Project BY Month
Like this:
Your Base Search Here .. | chart count OVER Project BY Month
With this command I don't have the Label in the cells.
I have projets and months but not labels.
How can I add labels in cells?