format splunk table

[edookati]

I have 3 fields date, hour & count(X). can someone please tell me how to forma table like below...count of X

      date1       date2 

---

Hour1 count(X) count(X)
Hour2 count(X) count(X)

Thanks.

[somesoni2 · Accepted solution]

I am assuming you have some aggregation command like "stats" to get those three columns. If that is the case I would recommend to rename the "count(X)" as countX or something similar.

Try this

Your base search giving date, hour , countX fields | chart sum(countX) as countX over hour by date

OR

Your base search giving date, hour, X fields | chart count(X) as countX over hour by date

OR

your base search giving date, hour, count(X) fields | chart sum("count(X)") as countX over hour by date

[edookati]

fantastic. It worked.
Thanks.