----| stats sparkline as magnitude_trend,count by rest_api_name,http_status_code,a | lookup AppIdLookUp a OUTPUT PartnerName | sort PartnerName
Above is my query to do refer a lookup file and populate the PartnerName. Currently I have about 100+ PartnerNames and each Partner has 5 to 10 rest api names. My stats table look like big grid.
For easy reading, I wanted to add a colored space row or separator after each PartnerName sorted like below
restname1 statuscode-400 count PartnerA
restname2 statuscode-400 count PartnerA
restname3 statuscode-400 count PartnerA
restname1 statuscode-400 count PartnerB
restname2 statuscode-500 count PartnerB
restname3 statuscode-401 count PartnerB
restname1 statuscode-200 count PartnerC
restname2 statuscode-400 count PartnerC
restname3 statuscode-500 count PartnerC
Appreciate any suggestions
To generate the row itself, you could do something like this:
... | stats ... | lookup ... | appendpipe [stats count by PartnerName | fields - count | eval rest_api_name="ZZZ make sure this causes the row to sort towards the end"] | sort PartnerName rest_api_name | eval rest_api_name=case(NOT match(rest_api_name, "^ZZZ"), rest_api_name)
That should insert a row per partner, set the rest name to some placeholder to be sorted towards the end, do the sort, hide the placeholder.
Colouring the separator row can be done with a bit of JS and CSS in dashboards.
To generate the row itself, you could do something like this:
... | stats ... | lookup ... | appendpipe [stats count by PartnerName | fields - count | eval rest_api_name="ZZZ make sure this causes the row to sort towards the end"] | sort PartnerName rest_api_name | eval rest_api_name=case(NOT match(rest_api_name, "^ZZZ"), rest_api_name)
That should insert a row per partner, set the rest name to some placeholder to be sorted towards the end, do the sort, hide the placeholder.
Colouring the separator row can be done with a bit of JS and CSS in dashboards.