So I have a data set and with some splunk magic, I was able to display the results in the following format:
query:
..... | stats count by error, state | sort count | chart list(error) as error, list(count) as count by state
Results:
State error Count
----- ----- -----
CA 21102 69
42112 32
10551 45
81092 15
10453 18
VA 21102 18
42112 10
10551 16
81092 19
10453 12
WA 21102 17
42112 11
81092 31
10453 10
What I would like to see is the count over last 7 days which would give me the results like below:
State error 06/24 06/25 06/26 06/27
----- ----- ----- ----- ----- -----
CA 21102 11 19 21 21
42112 11 12 12 15
10551 11 12 14 17
81092 16 13 15 19
10453 11 17 18 11
VA 21102 11 19 21 21
42112 11 12 12 15
10551 11 12 14 17
81092 16 13 15 19
10453 11 17 18 11
WA 21102 11 19 21 21
42112 11 12 12 15
81092 16 13 15 19
10453 11 17 18 11
Basically splitting the count by date.
... View more
