I have a search which return below results:
status total_user
passed 7
failed 3
unknown 14
How can I change the table so that it can display like this:
passed failed unknown total
7 3 14 24
I tried this but it is not working:
stats values(eval(status="passed")) AS passed values(eval(status="failed")) AS failed values(eval(status="unknown")) AS unknown sum(total_user) AS Total
Add this at the end of your original search string. I will format the data in the desired format.
... | eval dummy=" " | xyseries dummy status total_user | fields - dummy | addtotals
I hope this helps.
Thanks! It solved my problem. 🙂
Then you should come back and click Accept
to close the question, @cycheng.