Rearrange the stats output.

[onthakur]

Team,

I got stats output as below and I need to rearrange

stats current output :-

transaction_id  source count
12345                   ABC      1
12345                   XYZ       1

Required Output :-

transaction_id   ABC    XYZ
12345                      1          1

[gcusello · Accepted solution]

Hi @onthakur ,

use chart command, instead stats:

<your_search>
| chart count OVER source  BY transaction_id  

Ciao.

Giuseppe

[onthakur]

This resolution worked with minor changes . Many thanks for your help

| chart count OVER transaction_id BY source

[gcusello]

Hi @onthakur ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉