https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447951#M126953 <P>are a_snake a_cat, etc field names or values? I feel like you may be generalizing too much and something is getting lost. Your table command treats them like fields but then your example table has them like values.</P> Tue, 29 Sep 2020 19:51:02 GMT kmaron 2020-09-29T19:51:02Z https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447948#M126950 <PRE><CODE>| base query with some eval commands | table a_snake, a_cat, a_dog, b_snake, b_cat, b_dog, c_snake, c_cat, c_dog </CODE></PRE> <P>However, I want the values to be arranged like this with the column header as SNAKE, CAT, DOG</P> <PRE><CODE>SNAKE CAT DOG a_snake a_cat a_dog b_snake b_cat b_dog c_snake c_cat c_dog </CODE></PRE> Wed, 06 Jun 2018 13:15:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447948#M126950 zacksoft 2018-06-06T13:15:46Z https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447949#M126951 <P>What do your events actually look like?</P> <P>And what output does your existing <CODE>table</CODE> command show?</P> <P>(It might actually be useful to know what those eval commands are, but they may not be important)</P> Wed, 06 Jun 2018 14:02:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447949#M126951 Richfez 2018-06-06T14:02:20Z https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447950#M126952 <P>The existing output is,<BR /> There is One row and Nine columns<BR /> And the column headers are left to right specified as a_snake a_cat a_dog b_snake b_cat b_dog .....</P> Tue, 29 Sep 2020 19:55:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447950#M126952 zacksoft 2020-09-29T19:55:40Z https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447951#M126953 <P>are a_snake a_cat, etc field names or values? I feel like you may be generalizing too much and something is getting lost. Your table command treats them like fields but then your example table has them like values.</P> Tue, 29 Sep 2020 19:51:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447951#M126953 kmaron 2020-09-29T19:51:02Z https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447952#M126954 <P>Using what you provided this is what I have</P> <PRE><CODE>| makeresults | eval animal = "a_cat a_snake a_dog b_cat b_snake b_dog c_cat c_snake c_dog" | makemv animal | mvexpand animal | rex field=animal "^(?&lt;Letter&gt;.*?)_(?&lt;Type&gt;.*?)$" | eval Type = upper(Type) | chart values(animal) over Letter by Type | fields - Letter </CODE></PRE> Wed, 06 Jun 2018 16:58:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-reformat-the-table-output/m-p/447952#M126954 kmaron 2018-06-06T16:58:55Z