I have a command
host="daily" | chart count by Company, date_mday
which shows the fields
Company, 1, 10, 11, 15, 2, 3, 4, 7, 8, 9, Other
I want the column order to be numerically ordered by day of month and I want all columns displayed for all results, so I need to specify widths for the table.
How do I do this?
host="daily" | eval mday = if(date_mday<10,"0".date_mday,date_mday) | chart useother=false limit=0 count by Company, mday | fillnull count value=0
This should get you most of the way there. It might need adjusted to fill in the null counts.
host="daily" | eval mday = if(date_mday<10,"0".date_mday,date_mday) | chart useother=false limit=0 count by Company, mday | fillnull count value=0
This should get you most of the way there. It might need adjusted to fill in the null counts.
Thanks alacercogitatus! The eval statement shows me how to sort out the column ordering and the limit=0 makes it show all columns. useother in this case is redundant, but I understand where you're going with it. The fillnull simply added an extra 'count' column, but without it, it gave exactly what I needed.