How to group the data

[haripotu]

We have the count of different fields We need to get all that data on x-axis for the that we are using appendcols more than thrice. Our data base contains huge data running search command more than once is creating a problem. We would like to group the count data. Can i please know how.

Below is the query we are using:

index="main" sourcetype="SF1"
| stats count(CASS_RESULT) as CASS by CASS_RESULT
|appendcols [search index="main" sourcetype="SF4"
| stats count(DIALOGUE_RESULT) as DIALOGUE by DIALOGUE_RESULT]
|appendcols [search index="main" sourcetype="SF2"
| stats count(TPOS_RESULT) as TPOS by TPOS_RESULT]
|appendcols [search index="main" sourcetype="SF3"
| stats count(PCO_RESULT) as PCO by PCO_RESULT]
|appendcols [search index="main" sourcetype="SF5"
| stats count(VAS_RESULT) as VAS by VAS_RESULT]
|table CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| transpose header_field=CASS_RESULT

[ITWhisperer]

The way you are using appendcols means that the data in the rows has no real relationship to each other apart from the order in which they are returned from the stats commands, therefore, you could try something like this

index="main" sourcetype="SF1"
| eventstats count(CASS_RESULT) as CASS by sourcetype CASS_RESULT
| eval CASS=if(sourcetype="SF1",CASS,null())
| eval CASS_RESULT=if(sourcetype="SF1",CASS_RESULT,null())
| eventstats count(DIALOGUE_RESULT) as DIALOGUE by sourcetype DIALOGUE_RESULT
| eval DIALOGUE=if(sourcetype="SF4",DIALOGUE,null())
| eventstats count(TPOS_RESULT) as TPOS by sourcetype TPOS_RESULT
| eval TPOS=if(sourcetype="SF2",TPOS,null())
| eventstats count(PCO_RESULT) as PCO by sourcetype PCO_RESULT
| eval PCO=if(sourcetype="SF3",PCO,null())
| eventstats count(VAS_RESULT) as VAS by sourcetype VAS_RESULT
| eval VAS=if(sourcetype="SF5",VAS,null())
| table sourcetype CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| dedup sourcetype CASS_RESULT CASS DIALOGUE TPOS PCO VAS
| streamstats count as row by sourcetype
| stats values(*) as * by row
| fields - row
| transpose header_field=CASS_RESULT