Hi, I got a set of table that has "_time" as row values and "hosts" as column values like below.
How can I group them based on their host name (host-1 & host-2) and add the values of two sub_hosts(e.g. "host-1" = "host-1-1" + "host-1-2")? So the result will look like below.
| eval _raw="time,host-1-1,host-1-2,host-2-1,host-2-2
| multikv forceheader=1
| fields - _* linecount
| rename host_*_* as host-*-*
| untable time host count
| eval host=mvjoin(mvindex(split(host,"-"),0,-2),"-")
| stats sum(count) as count by time host
| xyseries time host count
For your case, you need the lines after the blank lines and use _time instead of time
Hi @hannahb Try This:
------your search | rename host1-1 as host1, host2-1 as host2 | rename host1-2 as host1, host2-2 as host2 | stats count(host1) as host1, count(host2) as host2 by _time