Transforming table and merging columns

[FaridHamidi]

Hi everyone. 

I have this result of my sear ch here in table below.

is there a way to transform the table into something like this,  separating the 2 rows (successful & unsuccessful) into merchand_id field.

Thanks!

[ITWhisperer]

Chart will get you close to what you want and with a couple of transpose and rex to rename and sort you can group merchant stats together

| makeresults | eval events="aaa,10,4,6|bbb,20,5,15|ccc,25,12,13"
| eval events=split(events,"|")
| mvexpand events
| eval _time=_time-24*60*60
| append [
| makeresults | eval events="aaa,10,6,4|bbb,20,15,5|ccc,25,13,12"
| eval events=split(events,"|")
| mvexpand events
]
| rex field=events "(?<merchant>[^,]+),(?<total>[^,]+),(?<success>[^,]+),(?<fail>.+)"
| fields - events
| chart sum(total) as total sum(success) as success sum(fail) as fail by _time, merchant
| transpose 0
| rex mode=sed field=column "s/(?<result>[^:]+):\s(?<merchant>.+)/\2: \1/g"
| sort column
| transpose 0 header_field=column
| fields - column