https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587944#M1578 <P>Edited: Bad first response. You can do this with two stats&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">your_search | stats count by Date Group State | eval "Total{State}"=count | fields - State count | stats values(*) as * by Date Group | addtotals</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Tue, 08 Mar 2022 21:31:12 GMT bowesmana 2022-03-08T21:31:12Z https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587942#M1577 <DIV> <DIV> <DIV class=""> <DIV class="">&nbsp;</DIV> </DIV> <DIV class=""> <DIV class=""> <P>I have following splunk fields</P> <PRE>Date,Group,State </PRE> <P>State can have following values InProgress|Declined|Submitted</P> <P>I like to get following result</P> <PRE>Date. Group. TotalInProgress. TotalDeclined TotalSubmitted. Total ----------------------------------------------------------------------------- 12-12-2021 A. 13. 10 15 38</PRE> <P>I couldn't figured it out. Any help would be appreciated</P> </DIV> </DIV> </DIV> </DIV> Tue, 08 Mar 2022 05:10:14 GMT https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587942#M1577 Leo_Pegasus 2022-03-08T05:10:14Z https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587944#M1578 <P>Edited: Bad first response. You can do this with two stats&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">your_search | stats count by Date Group State | eval "Total{State}"=count | fields - State count | stats values(*) as * by Date Group | addtotals</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Tue, 08 Mar 2022 21:31:12 GMT https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587944#M1578 bowesmana 2022-03-08T21:31:12Z https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587949#M1579 <P>You need to concatenate the fields, do the stats (well chart to be precise), then split the concatenated field</P><LI-CODE lang="markup">| makeresults count=100 | eval date=strftime(relative_time(now(),"-".(random()%10)."d@d"),"%F") | eval group=mvindex(split("ABC",""),random()%3) | eval state=mvindex(split("InProgress|Declined|Submitted","|"),random()%3) | eval dategroup=date."|".group | chart count by dategroup state | addtotals | eval date=mvindex(split(dategroup,"|"),0) | eval group=mvindex(split(dategroup,"|"),1) | fields - dategroup | table date group * Total</LI-CODE> Tue, 08 Mar 2022 07:35:07 GMT https://community.splunk.com/t5/Other-Usage/How-to-group-by-multiple-fields/m-p/587949#M1579 ITWhisperer 2022-03-08T07:35:07Z