Trying to put together a table that compares service versions across environments.
Able to get a list using stats
Would like to have this same info organized as a table, tried
but this doesn't return service versions like 1.2.31
Seems that chart only works with numbers - figure there must be some other way to build a table.
That's right, timechart and chart do their best to only return numeric data, so first() and values() wont work as you might expect for non-numeric fields.
for more on that topic, see this related question: http://answers.splunk.com/questions/2295/how-come-some-fields-disappear-when-they-go-into-timechart-chart
So, you cant use chart, you have to use stats. And the xyseries command can convert the "stats output format", where each row is a unique combination, to what you might call the "chart output format" that's the 2-dimensional table that you want.
I don't think this is what it was designed for, but it turns out maketable does exactly what is needed.
search... | stats first(version) as version by environment service | maketable service environment version
answered 11 May '10, 17:37