How to group the data?

Follow

Sai Gowtham Nambi

• May 11, 2020 10:45
• Edited

Hi, 

Please help me with this. i have a query _sourceCategory=prod/* and source ="xyz" | parse regex "collectorStatus=(?<status>.*?)[,|\]]"
| count(*) by source,status will result a table data

#	source	status	_count
1	xyz	INVALID_CREDENTIALS	12
2	xyz	SUCCESS	1,198
3	xyz	BAD_STATUS	15
4	xyz	BAD_URL	7
5	xyz	INVALID_URL	8

 

But i want the result to be shown in the below format. Is possible to do it in this way?

# source      INVALID_CREDENTIALS   SUCCESS     BAD_STATUS   BAD_URL    INVALID_URL

1      xyz                            12                     1,198                  15                     7                     8

 

 

1

• 

  Latimer Luis

  • May 11, 2020 16:00

  You may want to consider reviewing our Transpose operator. I believe what you're looking for should be possible with the following:

  _sourceCategory=prod/* and source ="xyz" | parse regex "collectorStatus=(?<status>.*?)[,|\]]"
  | count(*) by source,status
  | transpose row source column status
  
  

  0

  Comment actions Permalink

Please sign in to leave a comment.