Hi,
I'm trying to display only a value in one particular column, for instance represent one team for different status. This is what I've done so far:
index=xxx | stats count by Team, status
*my expecting result is to have only one "DevOps" to represent team for different status displayed.
Team | Status | Count
DevOps Assigned 10
Pending 5
New 2
Resolved 1
..........
Many thanks for any help 🙂
You could try something like this:
index=xxx | stats count by Team, status
|eval field="status=" .status. " ". "count=" .count
|stats values(field) as stats by Team
You could try something like this:
index=xxx | stats count by Team, status
|eval field="status=" .status. " ". "count=" .count
|stats values(field) as stats by Team
Thanks Matt!!!
hi @aa0,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
Hi @aa0,
it isn't possible!
It's possible (but it's quite long to implement) to have something like this:
Team | Status | Count
DevOps
Assigned 10
Pending 5
New 2
Resolved 1
Ciao.
Giuseppe
So what will be the possible query to begin with?