How to display the values in search result as fields?

[cycheng]

I have a search which return below results:

status      total_user
passed      7
failed      3
unknown     14

How can I change the table so that it can display like this:

passed     failed    unknown    total
  7          3         14         24

I tried this but it is not working:
stats values(eval(status="passed")) AS passed values(eval(status="failed")) AS failed values(eval(status="unknown")) AS unknown sum(total_user) AS Total

[Gilberto_Castil]

Add this at the end of your original search string. I will format the data in the desired format.

... | eval dummy=" " | xyseries dummy status total_user | fields - dummy | addtotals

I hope this helps.

[cycheng]

Thanks! It solved my problem. 🙂

[woodcock]

Then you should come back and click Accept to close the question, @cycheng.