https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424925#M121840 <P>After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.</P> <P>e.g. (just an example of syntax)</P> <PRE><CODE>base search | chart count over "Survey Month" by "Survey Type" | eval "a"='a'*20 | where 'b'&lt;'a' | stats sum("b") as "B" by "a" </CODE></PRE> Thu, 13 Jun 2019 19:04:22 GMT somesoni2 2019-06-13T19:04:22Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424923#M121838 <P>I have done a chart command --&gt; chart count over "Survey Month" by "Survey Type" and the result displays the two survey types "a" and "b" as columns along with Survey month . Now how do i further reference column a and b to perform other calculations?</P> Thu, 13 Jun 2019 04:00:19 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424923#M121838 monyathomas 2019-06-13T04:00:19Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424924#M121839 <P>Can you provide some sample data and a more clear idea of what calculations you are looking to do after the initial chart command?</P> Thu, 13 Jun 2019 18:25:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424924#M121839 jnudell_2 2019-06-13T18:25:33Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424925#M121840 <P>After chart command, you'd see value of "Survey Type" field appearing as separate fields (in your example "a" and "b"). So you'd reference them like any other field, but would use "a" or "b" instead of "Survey Type". If they contain spaces, hyphen or other special characters, use them within single quotes in eval and where expressions, and within double quotes in other places.</P> <P>e.g. (just an example of syntax)</P> <PRE><CODE>base search | chart count over "Survey Month" by "Survey Type" | eval "a"='a'*20 | where 'b'&lt;'a' | stats sum("b") as "B" by "a" </CODE></PRE> Thu, 13 Jun 2019 19:04:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424925#M121840 somesoni2 2019-06-13T19:04:22Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424926#M121841 <P>Thanks a ton! This helps!</P> Fri, 14 Jun 2019 09:01:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424926#M121841 monyathomas 2019-06-14T09:01:56Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424927#M121842 <P>@monyathomas If your problem is resolved, please accept the answer to help future readers.</P> Sun, 16 Jun 2019 14:38:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424927#M121842 richgalloway 2019-06-16T14:38:39Z https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424928#M121843 <P>You should just be able to use <CODE>a</CODE> and <CODE>b</CODE> but if you need it to be oriented differently, then you can switch from using <CODE>chart</CODE> to using <CODE>stats</CODE> or you could use the <CODE>untable</CODE> command to do the same thing.</P> Sun, 16 Jun 2019 23:46:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-reference-columns-that-have-been-displayed-as-a-result/m-p/424928#M121843 woodcock 2019-06-16T23:46:15Z