**My Query:**
| tstats count where index=p___ AND error* by sourcetype,_time span=1d | eval count=tostring(count,"commas") |eval Day=strftime(_time,"%A") | eval Date=strftime(_time,"%m-%d-%Y") | stats list by sourcetype | rename list(Date) as Date list(Day) as "Day of the week" list(count) as Count | table sourcetype Date "Day of the week" Count
**Output**
sourcetype Date Day of the week Count
p____db2 08-26-2017 Saturday 4,44
08-27-2017 Sunday 6,24
p____syslog 08-27-2017 Sunday 45
**Expected Output**
sourcetype Date Day of the week Count
p____db2 08-26-2017 Saturday 4,44
08-27-2017 Sunday 6,24
p____syslog 08-26-2017 Saturday Not Available
08-27-2017 Sunday 45
↧