query : sourcetype=test | chart count by type, vendor | eval type_with_vendor=type.":".vendor | fields type_with_vendor, count, type
I want to show type_with_vendor and count on chart and pass type value on drilldown. How to do this? Is it any way to do?
Any help would be appreciated.
@nishu... How about reversing your eval and chart command.
sourcetype=test
| eval type_with_vendor=type.":".vendor
| chart count by type, vendor
| sort - count