Non-numerical values in a table

[NancyCunningham]

Trying to put together a table that compares service versions across environments.

Able to get a list using stats

 stats first(version) by service, environment

Would like to have this same info organized as a table, tried

 chart first(version) by service, environment

but this doesn't return service versions like 1.2.31

Seems that chart only works with numbers - figure there must be some other way to build a table.

Thanks, Nancy

[vbumgarn]

I don't think this is what it was designed for, but it turns out maketable does exactly what is needed.

search... | stats first(version) as version by environment service | maketable service environment version

[gkanapathy]

actually that is exactly what xyseries was intended for

[Johnvey]

'maketable' is also known as 'xyseries'.

[sideview]

That's right, timechart and chart do their best to only return numeric data, so first() and values() wont work as you might expect for non-numeric fields.

for more on that topic, see this related question: http://answers.splunk.com/questions/2295/how-come-some-fields-disappear-when-they-go-into-timechart-...

So, you cant use chart, you have to use stats. And the xyseries command can convert the "stats output format", where each row is a unique combination, to what you might call the "chart output format" that's the 2-dimensional table that you want.

stats first(version) by service, environment | xyseries service, environment, first(version)