Trying to put together a table that compares service versions across environments.
Able to get a list using stats
stats first(version) by service, environment
Would like to have this same info organized as a table, tried
chart first(version) by service, environment
but this doesn't return service versions like 1.2.31
Seems that chart only works with numbers - figure there must be some other way to build a table.
Thanks, Nancy
I don't think this is what it was designed for, but it turns out maketable does exactly what is needed.
search... | stats first(version) as version by environment service | maketable service environment version
actually that is exactly what xyseries
was intended for
'maketable' is also known as 'xyseries'.
That's right, timechart and chart do their best to only return numeric data, so first() and values() wont work as you might expect for non-numeric fields.
for more on that topic, see this related question: http://answers.splunk.com/questions/2295/how-come-some-fields-disappear-when-they-go-into-timechart-...
So, you cant use chart, you have to use stats. And the xyseries command can convert the "stats output format", where each row is a unique combination, to what you might call the "chart output format" that's the 2-dimensional table that you want.
stats first(version) by service, environment | xyseries service, environment, first(version)