bring column data to rows

[Haleem]

index=xxxx source=*xxxxxx*
| eval respStatus=case(responseStatus>=500, "ERRORS", responseStatus>=400, "EXCEPTIONS", responseStatus>=200, "SUCCESS" )
| stats avg(responseTime), max(responseTime) by client_id, servicePath, respStatus

The above query gives me the output as :

Haleem_0-1707168934624.png

I want to bring the respStatus column to split in 3 columns and should looks something like this:

Haleem_1-1707169004439.png

Want my table in this format :

 clientID | Service Path | Success count | Error Count | Exception Count | Avg Resp time | Max Resp time

[scelikok · Accepted solution]

Hi @Haleem,

Please try below;

index=xxxx source=*xxxxxx*
| stats avg(responseTime), max(responseTime), count(eval(respStatus >=500)) as "ERRORS", count(eval(respStatus >=400 AND respStatus <500)) as "EXCEPTIONS", count(eval(respStatus >=200 AND respStatus <400)) as "SUCCESS" by client_id servicePath

[Haleem]

Thank you so much. I appreciate your help @scelikok . you're awesome !