Splitting up data into multiple columns

[eb1929]

Hello i am using the following search 

host=XXX sourcetype=ZZZ http_status=500 OR http_status=502 "HighCostAPI"
| stats count by http_status, _time, pzInsKey
| fields http_status _time pzInsKey count
| addcoltotals count

I get the following results 

Which is what we wanted originally, now the customer would like to have a count for the 500 errors and the 502 errors separately. I guess it wouldn't be necessary to split the http_status into 2 columns just as long as i can have a count for both.   

[bowesmana · Accepted solution]

@eb1929 

You can use the appendpipe command to put 'subtotals' between the different status values like this

host=XXX sourcetype=ZZZ http_status=500 OR http_status=502 "HighCostAPI"
| stats count by http_status, _time, pzInsKey
| fields http_status _time pzInsKey count
| appendpipe [
  | stats sum(count) as count by http_status
  | eval pzInsKey="Total - Status code ".http_status
]
| sort http_status

which will give you a subtotal row with count as the total for the status. Note that the appendpipe also sets the pzInsKey field to a simple text string to indicate total.

In your dashboard you can then use a technique to highlight that subtotal row. (See dashboard examples Table Row Highlighting) for how to do that.

[eb1929]

That works thank you!!!

[scelikok]

Hi @eb1929,

You can count http_status codes separately like below;

host=XXX sourcetype=ZZZ http_status=500 OR http_status=502 "HighCostAPI"
| eval status_500=if(http_status==500,1,0)
| eval status_502=if(http_status==502,1,0)
| stats sum(status_500) as status_500 sum(status_502) as status_502 count by http_status, _time, pzInsKey
| fields http_status _time pzInsKey status_500 status_502 count
| addcoltotals status_500 status_502 count

If this reply helps you an upvote is appreciated.

[eb1929]

This one worked as well thank you both for this!!!