How to edit my search to get the output fields to show up as their own columns to sort on?

[TJ0214]

I am unable to get the output fields to show up as columns instead of multiple entries of users.

Here is my search:

index=es_sec_box_ko event_type!="*token_refresh" event_type=UPLOAD OR event_type=DOWNLOAD OR event_type=PREVIEW OR event_type=EDIT OR event_type=DELETE | stats count by created_by_login event_type

stats count by created_by_login is where I think my issue is. I want Upload, Download, Preview etc to be in its own column that I can sort on. Anyone have some ideas?

[Runals]

I'd also try somesoni2's suggestion. If you wanted to sort one of the columns though you would need to do something like

... | stats ... | sort ... | xyseries ...

That said you already know what the column names are going to be so you could just pick one and sort by it. The biggest thing to remember is that when you use chart/timechart and have a function like count that would normally turn into a field name it doesn't exist after the chart/timechart pipe.

[somesoni2]

Try this

index=es_sec_box_ko event_type!="*token_refresh" event_type=UPLOAD OR event_type=DOWNLOAD OR event_type=PREVIEW OR event_type=EDIT OR event_type=DELETE | chart count over _login by event_type limit=0