Hi,
Kindly help on sorting the values from append query as below:
index=* source=* |stats sum(Tot) sum(in_prog) sum(submitted) sum(without_info) by Month |append [search index=* source=* chart count by Month,with_info, |addtotals with_info]
|append [search index=* source=* chart count by Month,without_info, ]
|untable Month,Category,Total |eval sort_field=case(Category="Tot",1,Category="in_prog",2,Category="Submitted",3,Category="without_info",4, Category="with_info",5) |sort sortfield |stats list(Category) as Category list(Total as Total by Month
Result:
Month Category Total
Feb-23 Tot 1000
in_prog 400
Submitted 600
without_info 100
with info 500
Occupation xxx
Business xxx
Null xxx
Others xxx
From the above table, Occupation, Business are reasons derived from first append query and Null, Others are reasons derived from second append query and getting the append query results in the last.
So, requirement is to display the without_info reasons next to that field and with_info reasons next to that field like below. Kindly help on sorting.
Month Category Total
Feb-23 Tot 1000
in_prog 400
Submitted 600
without_info 100
Null xxx
Others xxx
with info 500
Occupation xxx
Business xxx
... View more