I am trying to add a column to my current chart which has "Customers" as one column and "Users" as another.
e.g. Customers Users
Wells fargo abc@wf.com
123@wf.com
TestAccount@wf.com
UBS lol@ubs.com
TestAccount2@ubs.com
But I want to make a third column of all the test accounts for each customer like so:
e.g. Customers Users Test Accounts
Wells fargo abc@wf.com TestAccount@wf.com
123@wf.com
UBS lol@ubs.com TestAccount2@ubs.com
I know I can filter on the userid so I am able to get two separate charts but I don't know how to merge them. Can someone help?
Here are my searches for each chart:
index=info | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"
index=info userid="TestAccount*" | chart values(userid) by Customer_Name | rename values(userid) as "User", Customer_Name as "Customer"
Try like this
Updated
index=info | stats values(userid) as userid by Customer_Name
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount
Try like this
Updated
index=info | stats values(userid) as userid by Customer_Name
| eval User=mvfilter(NOT match(userid,"TestAccount"))
| eval TestAccount=mvfilter(match(userid,"TestAccount"))
| rename Customer_Name as Customer
| table Customer User TestAccount
@somesoni2 - missing open paren on second mvfilter.
Thank you! This is exactly what I needed
Thank you sir.