https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371966#M7139 <P>Awesome.. this solution worked !</P> Mon, 02 Oct 2017 18:14:31 GMT shah_nishay 2017-10-02T18:14:31Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371964#M7137 <P>I have a query where I eval 3 fields by substracting different timestamps</P> <P>eval Field1 = TS1-TS2<BR /> eval Field2 = TS3-TS4<BR /> eval Field3 = TS5- TS6<BR /> eval Date = strftime(_time, "%m-%d-%Y")<BR /> Next I use the stats command to calculate count, min,max,average for these 3 evaluated Fields by date.</P> <P>If use stats count(Field1), count(Field2),count(Field3) by Date then I end up with all the values in same row.<BR /> How can i get these stats for each Fields in different line ?<BR /> i.e my out put should look like :</P> <P>Date,Fields,Min,Max,Avg<BR /> 10/2/2017, Field1,5,10,8<BR /> 10/2/2017, Field2,15,110,30<BR /> 10/2/2017, Field3,11,102,58<BR /> 10/3/2017, Field1,15,110,28<BR /> 10/3/2017, Field2,25,210,100<BR /> 10/3/2017, Field3,12,110,60</P> Mon, 02 Oct 2017 16:45:43 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371964#M7137 shah_nishay 2017-10-02T16:45:43Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371965#M7138 <P>Try like this</P> <PRE><CODE>your base search | eval Field1 = TS1-TS2 | eval Field2 = TS3-TS4 | eval Field3 = TS5- TS6 | eval Date = strftime(_time, "%m-%d-%Y") | table Date Field1 Field2 Field3 | untable Date Fields Value | stats min(Value) as Min max(Value) as Max avg(Value) as Avg by Date Fields </CODE></PRE> Mon, 02 Oct 2017 17:10:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371965#M7138 somesoni2 2017-10-02T17:10:58Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371966#M7139 <P>Awesome.. this solution worked !</P> Mon, 02 Oct 2017 18:14:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-create-a-table-of-eval-fields-along-with-stats/m-p/371966#M7139 shah_nishay 2017-10-02T18:14:31Z