How to transpose based on regex data to get the counts

[kuul13]

Hi,

I am new to Splunk. I am trying to figure out how to extract count of errors per api calls made for each client.

I have following query that i run :

`index=application_na sourcetype=my_logs:hec source=my_Logger_PROD  retrievePayments* ( returncode=Error OR returncode=Communication_Error) | rex field=message "Message=.* \((?<apiName>\w+?) -" |  lookup My_Client_Mapping client | table ClientName, apiName'

This query parses message to extract the apinames that starts with `retrievePayments`.  And shows this kind of results

ClientName  apiName

Client A          retrievePaymentsA

Client B          retrievePaymentsA

Client C         retrievePaymentsB

Client A         retrievePaymentsB

I want to see an output where my wildcard apiName are transposed and show error count for every client. 

Client      retrievePaymentsA    retrievePaymentsB     retrievePaymentsC    retrievePaymentsD

Client A  2                                     5                                             0                                         1

Client B  2                                     2                                             1                                         6

Client C  8                                     3                                             0                                         0

Client D  1                                     0                                            4                                         3

Any help would be appreciated.

[bowesmana · Accepted solution]

@kuul13 

This is a straightforward use of the chart command, see this run anywhere example

| makeresults count=20
| fields - _time
| eval ClientName=mvindex(split("ABC",""), random() % 3)
| mvexpand ClientName
| eval ClientName="Client ".ClientName
| eval apiName="retrievePayments".mvindex(split("ABCD",""), random() % 4)
| chart count over ClientName by apiName

This sets up some example data and then uses the chart command do to the tabling you need.