I have this query where i want my data in a specific format .
Here under each POD there are some 3-4 hosts ,whose total event count is 5 ...(highlighted)
Base query|stats count by host|addcoltotals
Similarly for POD 2 i have some different set of hosts whose counts is 10
Message POD1 POD2 Total
XYZ ........ 5.............10.......... 15
I used below query:
index="River" sourcetype=river_logs host="XYZ" OR "host="ABC" OR host="LM" OR "host="NOP" Message="*" |eval host=upper(host)|eval env=case( host=="XYZ" OR "host="ABC","POD1",host=="LM" OR "host=="NOP","POD2",1==1,"NOT MATCHED")|stats count by host env | chart values(count) over host by env
Which is giving result as :
WHICH IS NO THE expected format of result .(". "are nothing but the spaces to show how exactly result is popping)
Please help me with this one
Is your expected output is host being first column or Message being first column?
I am not sure why have you used two statistics i.e. stats and chart when you are trying to just perform count.
Following should give you the results you are expecting.
<your base search> | chart count by host env | addtotals row=t col=f
1) If you want to reverse Column/Row split just reverse the by sequence i.e. chart count by env host
2) If you want to show column totals also then use change from col=f to col=t labelfield=host
I have just used .....chart count by env |addcolstotals |fillnull value="Total" env
Its actually giving result as:
I want it to be like
POD1 POD2 POD3 Total
5 2 3 10
I used transpose command but its giving result like:
column row1 row2 row 3
env POD1 POD2 POD3
Count 5 2 3
Is it possible to make "POD1" POD2 as table header instead of row 1, row 2 etc.
Please help me with this .