How to group the data?
Hi,
Please help me with this. i have a query _sourceCategory=prod/* and source ="xyz" | parse regex "collectorStatus=(?<status>.*?)[,|\]]"
| count(*) by source,status will result a table data
# | source | status | _count |
1 | xyz | INVALID_CREDENTIALS | 12 |
2 | xyz | SUCCESS | 1,198 |
3 | xyz | BAD_STATUS | 15 |
4 | xyz | BAD_URL | 7 |
5 | xyz | INVALID_URL | 8 |
But i want the result to be shown in the below format. Is possible to do it in this way?
# source INVALID_CREDENTIALS SUCCESS BAD_STATUS BAD_URL INVALID_URL
1 xyz 12 1,198 15 7 8
-
You may want to consider reviewing our Transpose operator. I believe what you're looking for should be possible with the following:
_sourceCategory=prod/* and source ="xyz" | parse regex "collectorStatus=(?<status>.*?)[,|\]]"
| count(*) by source,status
| transpose row source column status
Please sign in to leave a comment.
Comments
1 comment