Skip to main content
Sumo Logic

Lab 7 - Format Results

In order to to chart your data, sometimes you will need to format results to fit your desired chart needs.

 

  1. Create a chart that displays error codes by minute, over the last 15 minutes. Transposing your original results will allow you to create a table with time in your rows and status code in your columns.

_sourceCategory=Labs/Apache/Access

| parse "HTTP/1.1\" * " as status_code

| timeslice by 1m

| count by _timeslice, status_code

| transpose row _timeslice column status_code

Bonus: Filter out 304 and 200 status codes directly in the query to yield a better formatted chart. If done correctly, your results should look similar to the chart below.

Image of a better formatted chart