https://community.splunk.com/t5/Reporting/Combined-Pivots/m-p/418927#M6919 <P>Guys and girls,</P> <P>once again I need your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I am trying to run a query from a "flattened" set of events (KV Store) (pic1) and collect the result, a pivot-like resultset, with the grand total as a field (pic2) into an index.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6640iBD7EBB9BC1B06707/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6641i38E5343D60C0A885/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I am struggling to get it done. I have a couple of questions:</P> <P>1 - Is there any chance I can get the results displayed as JSON (inc. arrays)?<BR /> 2 - I am not sure pic2 is the result of a count with many "by" criteria, but more like 3 values(xxx) and 4 count(xxx) collated. How can I achieve this?</P> <P>Thanks.</P> Fri, 01 Mar 2019 15:08:00 GMT robettinger 2019-03-01T15:08:00Z https://community.splunk.com/t5/Reporting/Combined-Pivots/m-p/418927#M6919 <P>Guys and girls,</P> <P>once again I need your help <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I am trying to run a query from a "flattened" set of events (KV Store) (pic1) and collect the result, a pivot-like resultset, with the grand total as a field (pic2) into an index.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6640iBD7EBB9BC1B06707/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6641i38E5343D60C0A885/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>I am struggling to get it done. I have a couple of questions:</P> <P>1 - Is there any chance I can get the results displayed as JSON (inc. arrays)?<BR /> 2 - I am not sure pic2 is the result of a count with many "by" criteria, but more like 3 values(xxx) and 4 count(xxx) collated. How can I achieve this?</P> <P>Thanks.</P> Fri, 01 Mar 2019 15:08:00 GMT https://community.splunk.com/t5/Reporting/Combined-Pivots/m-p/418927#M6919 robettinger 2019-03-01T15:08:00Z