https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234879#M43348 <PRE><CODE>....|stats values(ERP_WP_PAYSTATEMENTS) as ERP_WP_PAYSTATEMENTS values(CDM_WP_PAYSTATEMENTS) as CDM_WP_PAYSTATEMENTS values(CDM_EE_LIEN_COUNT) as CDM_EE_LIEN_COUNT values(ARFF_WP_PAYSTATEMENTS) as ARFF_WP_PAYSTATEMENTS values(ARFF_EE_LIEN_COUNT) as ARFF_EE_LIEN_COUNT by TransactionId CLIENT_ID </CODE></PRE> <P>This should work if the paystatement values are fields. otherwise we might have to create some regex statements.</P> Tue, 22 Nov 2016 12:48:07 GMT cmerriman 2016-11-22T12:48:07Z https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234878#M43347 <P>After we process a client file, we get event in splunk as shown in below snapshot.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2159iF02AE9A535252B78/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>From these events I want to build a table something like below.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2160i5105705A47F89290/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Can someone please help?</P> <P>Regards,<BR /> Naveen</P> Tue, 22 Nov 2016 04:10:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234878#M43347 naveenchappa 2016-11-22T04:10:27Z https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234879#M43348 <PRE><CODE>....|stats values(ERP_WP_PAYSTATEMENTS) as ERP_WP_PAYSTATEMENTS values(CDM_WP_PAYSTATEMENTS) as CDM_WP_PAYSTATEMENTS values(CDM_EE_LIEN_COUNT) as CDM_EE_LIEN_COUNT values(ARFF_WP_PAYSTATEMENTS) as ARFF_WP_PAYSTATEMENTS values(ARFF_EE_LIEN_COUNT) as ARFF_EE_LIEN_COUNT by TransactionId CLIENT_ID </CODE></PRE> <P>This should work if the paystatement values are fields. otherwise we might have to create some regex statements.</P> Tue, 22 Nov 2016 12:48:07 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234879#M43348 cmerriman 2016-11-22T12:48:07Z https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234880#M43349 <P>Thank you @cmerriman it worked.</P> Tue, 22 Nov 2016 16:37:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-create-a-table-with-different-fields-from-different/m-p/234880#M43349 naveenchappa 2016-11-22T16:37:27Z