How to produce a table that can display 5xx status code counts per host over a timeframe?

[ccntech]

I am trying to produce a table that can display 5xx status code counts per host over a timeframe (this will eventually be month, but for the purpose of this example will be by day).

I downloaded the tutorial data  with apache logs and can see the data spans 8 days:

source="access.log" host="www*" sourcetype="access_combined_wcookie" status=500
|timechart span=1d count by host

I want to take this and analyze web server log files at work and increase span to 1 month. Is there a way for me to pivot /transform this data to get a breakdown that would provide the following table:

Daily 500 status code dashboard

host	02-25-22	02-26-22	02-27-22	etc	03-03-22
www1	13	39	35	etc	28
www2	24	31	45	etc	35
www3	18	51	34	etc	36

As stated above, I would like this by MONTH: Jan, Feb Mar etc so teams can glance at this table and see which hosts are improving/degrading or meeting SLOs etc. I do not want to create a bar chart, but rather keep the above format.

[yuanliu]

The command you are looking for is transpose. (I recently did the same.)  Instead of timechart, start with chart. The following uses 1 week as example, and anchors at beginning of week. (C.f., How to specify relative time modifiers.)

source="access.log" host="www*" sourcetype="access_combined_wcookie" status=500
| bin span=1w@w _time
| chart count over _time by host
| eval _time=strftime(_time, "%m-%d-%y")
| transpose 0 header_field=_time column_name=host

[ccntech]

This is perfect! Thank you for such a quick reply! 

[ITWhisperer]

Try this:

| timechart span=1mon count by host