Required arguments

Optional arguments

Alias

The alias for the xyseries command is maketable.

Results with duplicate field values

When you use the xyseries command to converts results into a tabular format, results that contain duplicate values are removed.

You can use the streamstats command create unique record numbers and use those numbers to retain all results. For an example, see the Extended example for the untable command.

Write a search

Run this search in the search and reporting app:

sourcetype=access_* status=200 action=purchase | top categoryId

The top command automatically adds the count and percent fields to the results. For each categoryId, there are two values, the count and the percent.

The search results look like this:

Identify your fields in the xyseries command syntax

In this example:

• <x-field> = categoryId
• <y-name-field> = count
• <y-data-field> = percent

Reformat search results with xyseries

When you apply the xyseries command, the categoryId serves as the <x-field> in your search results. The results of the calculation count become the columns, <y-name-field>, in your search results. The <y-data-field>, percent, corresponds to the values in your search results.

Run this search in the search and reporting app:

sourcetype=access_* status=200 action=purchase | top categoryId | xyseries categoryId count percent

The search results look like this:

Write a search

To add the optional arguments of the xyseries command, you need to write a search that includes a split-by-field command for multiple aggregates. Use the sep and format arguments to modify the output field names in your search results.

Run this search in the search and reporting app:

sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain

This search sorts referrer domain, count(host) and count(productId) by clientIp.

Run this search in the search and reporting app:

sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain  | xyseries clientip referer_domain count(host), count(productId)

In this example:

• <x-field> = clientip
• <y-name-field> = referrer domain
• <y-data-field> = host, productId

The xyseries command needs two aggregates, in this example they are: count(host) count(productId). The first few search results look like this:

Add optional argument: sep

Add a string to the sep argument to change the default character that separates the <y-name-field> host,and the <y-data-field> productId. The format argument adds the <y-name-field> and separates the field name and field value by the default ":"

Run this search in the search and reporting app:

sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain  | xyseries clientip referer_domain count(host), count(productId) sep="-"

The first few search results look like this:

Add optional argument: format

The format argument adds the <y-name-field> and separates the field name and field value by the default ":" For example, the default for this example looks like count(host):referrer_domain

When you specify a string to separate the <y-name-field> and <y-data-field> with the format argument, it overrides any assignment from the sep argument. In the following example, the sep argument assigns the "-" character to separate the <y-name-field> and <y-data-field> fields. The format argument assigns a "+" and this assignment takes precedence over sep. In this case $VAL$ and $AGG$ represent both the <y-name-field> and <y-data-field>. As seen in the search results, the <y-name-field>, host, and <y-data-field>, productId can correspond to either $VAL$ or $AGG$.

Run this search in the search and reporting app:

sourcetype=access_combined_wcookie | stats count(host) count(productId) by clientip, referer_domain  | xyseries clientip referer_domain count(host), count(productId) sep="-" format="$AGG$  + $VAL$ TEST"

The first few search results look like this:

Add optional argument: grouped

The grouped argument determines whether the xyseries command runs as a distributable streaming command, or a transforming command. The default state grouped=FALSE for the xyseries command runs as a streaming command.