transpose and xyseries

[mbasharat]

Hi,

I have search results in below format in screenshot1. I need that to be the way in screenshot 2. I used transpose and xyseries but no results populate. Compared to screenshots, I do have additional fields in this table. I only need the Severity fields and its counts to be divided in multiple columns as shown in screenshot 2. Rest of the fields will stay as is. I am missing something. How to do this? Thanks in-advance!!!

Now:

1.png

Need to be:

2.png

[ITWhisperer]

Something like this

| makeresults count=1 | eval _raw="abc.sample.com,Low,2|abc.sample.com,Medium,5|abc.sample.com,High,6|abc.sample.com,Critical,10"
| eval events=split(_raw,"|")
| mvexpand events
| eval events=split(events,",")
| eval DNS=mvindex(events,0), Severity=mvindex(events,1), Count=mvindex(events,2)
| fields DNS, Severity, Count
| fields - _*
---- above just recreates your data
| xyseries DNS, Severity, Count
| addtotals