|
I have the following search used to gather data which is used later in a hiddenpostprocess search : index=blah | stats count by Product_Group, Application, Severity, _time My postprocessing seach is :
Which outputs the data in a multiline per product format. ie.
3 columns. Product_group Severity and count. I would like to format the data like this.
Prior to using postprocessing a search that would provides the format I want would be :
Is it possible to use an eval within a stats sum(count)? Anytime I try to do an eval inside that I get zero values. edit #1: Tried using a chart command
But it is not fed the correct data so its wrong (but right visual format however!). |