chart command is useful for "turning" data across two dimensions. It is useful for both tables and charts. Let's start with one of our examples from
sourcetype="impl_splunk_gen" error | chart count over logger by user
The resulting table looks like this:
If you look back at the results from
stats, the data is presented as one row per combination. Instead of a row per combination,
chart generates the intersection of the two fields. You can specify multiple functions, but you may only specify one field each for
Switching the fields turns the data the other way.
By simply clicking on the chart icon above ...