Hi Friends,
Apologies for my ignorance, but I have a problem formatting the output of the result from a sub-query.
index=* "[92929292]"
| stats values(CALLGUID) as CALLGUID by _time_ | dedup CALLGUID| mvexpand CALLGUID
| join CALLGUID [ search index=* CALLGUID=*
| rex "D](:|\s-)(? [^,|.]+)" | stats count by CALLGUID error
| stats list(error) list(count) as count by CALLGUID]
| fields _time,CALLGUID,errors,count _
I’m working on the above query and I get the results as attached as actualoutput.png and desired_output.png
Could anyone please suggest how to make it work 😞
... View more