https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360847#M106647 <P>I have a set of data as below:<BR /> <IMG src="https://community.splunk.com/storage/temp/228695-screen-shot-2018-02-08-at-93225-am.png" alt="alt text" /></P> <P>If you can see, the TagNames are repetitive. I would want to re-arrange it to below format</P> <P>TagName LimitString1 LimitString2 LimitString3 .. . . . . . . . . .<BR /><BR /> CHEM_R13719 null 18<BR /> CHEM_R13720 null 01<BR /> .<BR /> .<BR /> CHEM_R13723 0 4940</P> <P>May I know how can I use stats command to achieve this? Thank you</P> Tue, 29 Sep 2020 17:58:48 GMT leonheart78 2020-09-29T17:58:48Z https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360847#M106647 <P>I have a set of data as below:<BR /> <IMG src="https://community.splunk.com/storage/temp/228695-screen-shot-2018-02-08-at-93225-am.png" alt="alt text" /></P> <P>If you can see, the TagNames are repetitive. I would want to re-arrange it to below format</P> <P>TagName LimitString1 LimitString2 LimitString3 .. . . . . . . . . .<BR /><BR /> CHEM_R13719 null 18<BR /> CHEM_R13720 null 01<BR /> .<BR /> .<BR /> CHEM_R13723 0 4940</P> <P>May I know how can I use stats command to achieve this? Thank you</P> Tue, 29 Sep 2020 17:58:48 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360847#M106647 leonheart78 2020-09-29T17:58:48Z https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360848#M106648 <P>Try...</P> <PRE><CODE> Your search | eval LimitString=coalesce(LimitString,"") | stats count by TagName LimitString </CODE></PRE> Thu, 08 Feb 2018 01:44:18 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360848#M106648 DalJeanis 2018-02-08T01:44:18Z https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360849#M106649 <P>Unfortunately, the output is not what I required. Basically, we need to sort the values in LimitString, into the respective TagName. I was reading up on the "bin" command, not sure it would help in getting what I wanted.</P> Fri, 09 Feb 2018 01:55:25 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360849#M106649 leonheart78 2018-02-09T01:55:25Z https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360850#M106650 <P>It seems you are looking for something like this:<BR /> index=.... | stats list(LimitString) as "Limit String" by TagName</P> Mon, 12 Feb 2018 06:00:29 GMT https://community.splunk.com/t5/Splunk-Search/Using-stats-to-organise-repetitive-data/m-p/360850#M106650 utk123 2018-02-12T06:00:29Z