- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to group by two months.
tabishritz
Observer
11-02-2020
08:22 AM
My query
"mwt-service" my query |stats count by channel service date_month
yields result like
channel | service | month | count |
PBX | FNTF | november | 4 |
STE | ACTR | november | 5 |
PBX | FNTF | october | 6 |
STE | ACTR | october | 9 |
But I want to have two columns of each month count as below
channel | service | nov | oct |
PBX | FNTF | 4 | 5 |
STE | ACTR | 3 | 8 |
please advice.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-02-2020
08:39 AM
| eval nov=if(month="november",count,null)
| eval oct=if(month="october",count,null)
| fields - month count
| stats values(*) as * by channel, service
