Hello,
I have two questions.
1) In my search below, I am trying to add Commas to the numbers, but the Totals field disappears when the search is using commas. When I remove stats count by action | eval count = tostring(count, "commas")
, everything shows up as expected, but without the commas.
index=pan_logs sourcetype=pan:threat log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low| stats count by action | eval count = tostring(count, "commas") | fields action count | rename action AS "Action", count as "Attempts" | addcoltotals|fillnull value="Total""
2) I would like to rename the row names. As you can see, I have already successfully renamed the columns, but I want to capitalize the rows as well.
Thank you
The problem is that once you convert "count" from an integer to a "string", any "adding" function can no longer work. So move the tostring
to the end like this:
index=pan_logs sourcetype=pan:threat log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low
| stats count AS Attempts BY action
| addcoltotals
| fillnull value="Total""
| eval count = tostring(Attempts, "commas")
| rename action AS "Action"
Try this
index=pan_logs sourcetype=pan:threat log_subtype!=url action=allowed OR action=blocked severity!=informational severity!=low | stats count by action | fields action count | rename action AS "Action", count as "Attempts" | addcoltotals|fillnull value="Total" | eval Action=upper(Action) | eval count = tostring(count, "commas")