I have a formating question.
When I run this:
index=userdata | eval platform=case(rl_user_agent like "%iPhone%", "Mobile" ,rl_user_agent like "%iPad%", "Mobile" , rl_user_agent like "%Android%", "Mobile" , 1=1, "Full Site") | eval status=case(rl_user_status=="Guest", "Guest", rl_user_status like "%Active%", "Active Sub", 1=1, "Registered") |rex field=rl_path "[/](?<path_root>[^/]*)" | eval path_root=upper(path_root) | table status path_root platform | stats count by status path_root platform | stats list(platform) AS Platform, list(count) AS count by status path_root
I get
status : path_root : Platform : count
status1 path1 full site 12
mobile 10
status1 path2 full site 12
mobile 10
but how can I get
status : path_root : full site : mobile
status1 path1 12 10
status1 path2 12 10
try like this:
...| chart count(eval(Platform="full site")) AS "full site",
count(eval(Platform="mobile ")) AS mobile by status path_root
or
...| stats count(eval(Platform="full site")) AS "full site" count(eval(Platform="mobile ")) AS mobile by status path_root
Try chart instead of stats
... | chart count over path_root by Platform
Might have to reverse your over/by fields in the chart command; I generally get those reversed.
You will likely have to do an eval to concatenate status and path and then rex to split them out though. There might be a better option presented by someone else as well.
this is getting me much closer