I am trying to arrange one of my column into rows. So I am using xyseries which is giving right results but the order of the columns is unexpected. Please help me to solve this.
My query is-
index=idx sourcetype=src1 |eval status=if(error,"status1",if(warning,"status2",if(debug,"status4","unknown"))) |stats count by field1 field2 field3 status |eval combination=mvappend(field1,field2,field3) |xyseries combination status count |rex combination "(?.)\s(?.)\s(?.*)"
I want result in below sequence-
field1 field2 status1 status2 status3 field3
But I am getting below result
field1 status1 status2 field2 field3 status3
I found the workaround for this. Specify field names for static one and "*" for dynamic fields.
|table field1 field2 * field3
Good Morning,
Can you select your answer?