Table : line column

[LauraBre]

Hello,
I created a search where I want to create a table including several cases.
My search include this: eval series=case(VE=7,'ok',VE=3,'ko',VE=2,'attempt') | chart count by series,day,hour.
I don t able to have the several case name in column and day and hour in line.

Thx by advance
Laura

[lguinn2]

I don't understand your question, but I see a problem in your case statement:

yoursearchhere |
eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | 
chart count by series,day,hour

I assume that day and hour are valid fields for all the events returned by the search? Are you sure that you want a chart and not a timechart? Here is a version that uses the timechart command instead:

yoursearchhere |
eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | 
timechart span=1h count by series