Multiple key value pairs in a timechart based on the counts of 2 fields

[datatan]

Here's an example of some error logs that simply show which app reported an error and which country:

_time(s)	sourcetype	country
0	app1	US
1	app1	DE
2	app2	DE
65	app2	US
66	app2	US
67	app1	DE

Here's the timechart I would like to retrieve(span=1m):

_time	app1	app2
2021-09-30 00:00:00	{"US": 1, "DE": 1}	{"DE": 1}
2021-09-30 00:01:00	{"DE": 1}	{"US": 2}

Is this, or something similar, possible?

[ITWhisperer]

Here is a runanywhere example - the part before the blank lines just sets up the dummy data

| makeresults
| eval _raw="_time(s)	sourcetype	country
0	app1	US
1	app1	DE
2	app2	DE
65	app2	US
66	app2	US
67	app1	DE"
| multikv forceheader=1
| eval _time=relative_time(_time,"@m")+time_s_
| bin _time span=1m



| stats count by _time sourcetype country
| eval results="\"".country."\": ".count
| stats values(results) as results by _time sourcetype
| eval results="{".mvjoin(results,", ")."}"
| xyseries _time sourcetype results