I have a question about the table. I want to know if we can have a multi dimensions table? We can't do a "count by" with three fields so how we can do it? I want to have a table where we have the number of event by hour in each day of a week for example.
Thx for your answer. I have this following problem:
source="tcp:5544" | eval Transac=case(D_LAB_ERR="TIMEOUT_REACHED" OR D_LAB_ERR="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure",STAT_VE="NO","VE No",STAT_VE="YES" AND SD_STAT_PA="YES","PA Yes",STAT_VE="YES" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="YES" AND SD_STAT_PA="NO", "PA No")|stats count by PURCH_MONTH,PURCH_DATE,Transac
In my search I want to have the Transac in column but with this I have them in line. How can I do to have PURCHMONTH and PURCHDATE in line and Transac in column???