|
Trying to put together a table that compares service versions across environments. Able to get a list using stats Would like to have this same info organized as a table, tried but this doesn't return service versions like 1.2.31 Seems that chart only works with numbers - figure there must be some other way to build a table. Thanks, Nancy |
|
That's right, timechart and chart do their best to only return numeric data, so first() and values() wont work as you might expect for non-numeric fields. for more on that topic, see this related question: http://answers.splunk.com/questions/2295/how-come-some-fields-disappear-when-they-go-into-timechart-chart So, you cant use chart, you have to use stats. And the xyseries command can convert the "stats output format", where each row is a unique combination, to what you might call the "chart output format" that's the 2-dimensional table that you want. |
|
I don't think this is what it was designed for, but it turns out maketable does exactly what is needed. search... | stats first(version) as version by environment service | maketable service environment version 'maketable' is also known as 'xyseries'.
(11 May '10, 17:46)
Johnvey
actually that is exactly what
(11 May '10, 22:27)
gkanapathy ♦
|
