My summary index search results for a timechart is as below: (index="siabc" | sitimechart sum(Count) by Host)
Time Host Count
19:15 server1 4446
19:15 server2 6536
19:15 server3 5863
19:15 server4 7822
19:20 server1 4461
19:20 server2 6244
19:20 server3 5565
19:20 server4 7713
19:25 server1 4478
19:25 server2 6060
19:25 server3 5715
19:25 server4 7998
How can i change to
Time server1 server2 server3 server4
19:15 4446 6536 5863 7822
19:20 4461 6244 5565 7713
19:25 4478 6060 5715 7998
↧