Imagine that I have a table of results like this:
Field1 Field2 Field3 Field4 Field5 Field6 Field7 Field8 Field9
1 0 1 0 0 3 0 0 3
1 0 3 1 0 1 1 0 0
2 0 1 0 1 3 0 0 3
1 0 3 1 0 1 1 0 1
3 0 2 0 0 3 0 0 3
1 0 3 1 0 3 0 0 1
3 1 1 0 0 1 1 0 3
0 0 3 1 1 2 1 0 1
For each column I want to have the following statistics:
Field1 with 0 Values: 1
Field1 with 1 Values: 4
Field1 with 2 Values: 2
Field1 with 3 Values: 2
Field2 with 0 Values: 8
Field2 with 1 Values: 1
Field2 with 2 Values: 0
Field2 with 3 Values: 0
Field3 with 0 Values: 0
Field3 with 1 Values: 3
Field3 with 2 Values: 1
Field3 with 3 Values: 4
Field4 with 0 Values: 4
Field4 with 1 Values: 4
Field4 with 2 Values: 0
Field4 with 3 Values: 0
...
until Field9.
How can I do this? And it´s possible to adapt to a line chart?
Thanks in advance.
Best Regards.
| makeresults
| eval _raw="Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9
1,0,1,0,0,3,0,0,3
1,0,3,1,0,1,1,0,0
2,0,1,0,1,3,0,0,3
1,0,3,1,0,1,1,0,1
3,0,2,0,0,3,0,0,3
1,0,3,1,0,3,0,0,1
3,1,1,0,0,1,1,0,3
0,0,3,1,1,2,1,0,1"
| multikv forceheader=1
| table Field1,Field2,Field3,Field4,Field5,Field6,Field7,Field8,Field9
`comment("this is your sample")`
`comment("from here , the logic")`
| eval tmp=1
| untable tmp field_name value
| eventstats count(eval(value=0)) as with0 count(eval(value=1)) as with1,
count(eval(value=2)) as with2 count(eval(value=3)) as with3 by field_name
| table field_name with*
`comment("I think above is enough, but as you want, i do")`
| untable field_name with_number value
| rex field=with_number mode=sed "s/with(\d)/with \1/"
| eval value = "value: ".value
Hi, @splunk_exercice
How about this?