I have a query as follows
| metadata type=hosts | search [| inputlookup dashboard_hosts_test.csv | rename my_hostname as host | eval host=lower(host)
| table host]
| eval lastTime=coalesce(lastTime,0)
| eval timeDiff=now()-lastTime
| eval last_seen_in_24_hours=if(timeDiff>86400,"Systems not reported to Splunk from last 24 hours","Systems reported to Splunk in last 24 hours")
| eval lastReported=if(lastTime=0,"never",strftime(lastTime,"%F %T"))
| stats count by last_seen_in_24_hours
which displays the result as follows
![alt text][1]
Now I want to modify the query to display the result as follows
![alt text][2]
[1]: /storage/temp/219571-hosts.png
[2]: /storage/temp/219572-hosts-days.png
What could be my final query in order to get the above results
↧