Splunk Search

Table : line column

LauraBre
Communicator

Hello,
I created a search where I want to create a table including several cases.
My search include this: eval series=case(VE=7,'ok',VE=3,'ko',VE=2,'attempt') | chart count by series,day,hour.
I don t able to have the several case name in column and day and hour in line.

Thx by advance
Laura

Tags (1)
0 Karma

lguinn2
Legend

I don't understand your question, but I see a problem in your case statement:

yoursearchhere |
eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | 
chart count by series,day,hour

I assume that day and hour are valid fields for all the events returned by the search? Are you sure that you want a chart and not a timechart? Here is a version that uses the timechart command instead:

yoursearchhere |
eval series=case(VE==7,"ok",VE==3,"ko",VE==2,"attempt") | 
timechart span=1h count by series
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!