I have the following search used to gather data which is used later in a hiddenpostprocess search :
index=blah | stats count by Product_Group, Application, Severity, _time
My postprocessing seach is :
Which outputs the data in a multiline per product format. ie.
3 columns. Product_group Severity and count.
I would like to format the data like this.
Prior to using postprocessing a search that would provides the format I want would be :
Is it possible to use an eval within a stats sum(count)? Anytime I try to do an eval inside that I get zero values.
edit #1: Tried using a chart command
But it is not fed the correct data so its wrong (but right visual format however!).
i was close with my first edit.
The solution for those playing at home.
So simple facepalm.
answered 23 May '12, 21:58