I have a below query:
index="auto_prod_cm_comparisions" sourcetype="auto_prod_details_log" source="/logs/web/output/iwarranty/" "/apps/web/sfw/java/" | search NOT Server_Name=*wb | chart values(Java_Version) over Java_Version by Server_Name
The above query view shows as below
Java_Version -------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172
jdk170_151--------------..............................jdk170_151................................... jdk170_151
jdk170_171.............. jdk170_171 ........................................jdk170_171
I want the view to be as below,how to do that?
Java_Version -----------------------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172
jdk170_151 jdk170_171-----------jdk170_171--------jdk170_151------------jdk170_171-----jdk170_151
Do you want to display on a single line?
(your search)|stats values(*) as *
@HiroshiSatoh,
The above worked, but now the ordering of columns have changed with Java_Version column now came at the middle. Of what I y=understand after the command "|stats values(*) as *" it has arranged the columns alphabetically. How to rearrange it back to the previous order?
You can use the | table field1,field2,...
command to order the fields as you desire.
@HiroshiSatoh
yes I need in a single line. Above query works for the servers and not under the java_version
What exactly do you mean that it doesn't work for the Java_Version field? You mean the multiple values in the field are displayed below each other? That's because it is a multi valued field.
You can combine that into a single value by using | eval Java_Version = mvjoin(Java_Version, " ")