How do I add a count to a table using the table command? The project I'm working on requires that a table is mad showing the day of the week, followed by a list of the users who logged on that day and how many time the logged on. The output looks something like this:
=============================================
Wednesday | user1 | 5
| user2 | 3
| user3 | 4
| user4 | 3
=============================================
I'm currently using this search to get some of what I need:
index=* date=* user=* | transaction date | table date user
But I can't get the count I need at the end. I tried appending a stats count:
index=* date=* user=* | transaction date | table date user | appendcols [search user=* | stats count by user]
But had no luck. Is there anyway to do this?
I would do like this (totally avoiding transaction command), will give the output in expected format.
index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date
I would do like this (totally avoiding transaction command), will give the output in expected format.
index=* date=* user=* | stats count by date user | stats list(user) as user list(count) as count by date
You, my friend, are a saint! This works perfectly. Thanks!
... | addcoltotals labelfield=change_name label=count