Hi,
Good day!
have this search:
| union
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Success"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Failed"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Warning"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
and I want my result to look like this.
Hope you can help me and thanks in advance!
can you try this
| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Success"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
| append
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Failed"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
| append
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4
| search field0="Warning"
| stats count as field3 by field1,field2
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]