Each day i execute my search
This search give me the number of events with status OK or KO by enterprise
nameEnterprise OK KO
Enterprise1 4 0
Enterprise2 76 0
Enterprise3 4 0
I'd like to see in my dashboard the result of my search for severals days
day1 day2 day3
OK KO OK KO OK KO
Enterprise1 4 0 83 3 1 0
Enterprise2 76 0 5 1 5 0
Enterprise3 4 1 15 0 12 2
Is it possible ?
sorry for the presentation of tables
Splunk doesn't support two-level columns or merged cells. You can however have the columns like Date1: KO, Date1: OK
. If you would've shared you search, we could provide better answer, but it'll something like this
your base search
| eval DayStatus=strftime(_time,"%F").":".Status
| chart count over nameEnterprise by DayStatus
Splunk doesn't support two-level columns or merged cells. You can however have the columns like Date1: KO, Date1: OK
. If you would've shared you search, we could provide better answer, but it'll something like this
your base search
| eval DayStatus=strftime(_time,"%F").":".Status
| chart count over nameEnterprise by DayStatus
The question is not clear,but as per my understanding you need to plot a table with enterprisename status and Days,you can use chart command for this:
your search |chart status OVER Days BY enterprisename