https://community.splunk.com/t5/Splunk-Search/Table-with-Multiple-by-Fields/m-p/515792#M144826 <P>The <FONT face="courier new,courier">chart</FONT> command allows only a single <FONT face="courier new,courier">by</FONT> clause.<BR />Please share the desired output.</P> Mon, 24 Aug 2020 13:35:11 GMT richgalloway 2020-08-24T13:35:11Z https://community.splunk.com/t5/Splunk-Search/Table-with-Multiple-by-Fields/m-p/515670#M144792 <P>I have a search that I have been asked to organize in a different way.</P><P>Mysearch | rex (FieldA)(FieldB)(FieldC)(FieldD) | chart latest(FieldD),FieldC by FieldB by FieldA</P><P>FieldD and FieldC have unique values</P><P>There will be multiple FieldD values for each FieldB and multiple FieldB values for FieldA</P><P>That will be for the full list, at some point I have been asked to do a relation for the top values of FieldD compared to FieldB as well.</P><P>I am a bit lost as to how to proceed with this.</P> Mon, 24 Aug 2020 02:08:08 GMT https://community.splunk.com/t5/Splunk-Search/Table-with-Multiple-by-Fields/m-p/515670#M144792 Ladron 2020-08-24T02:08:08Z https://community.splunk.com/t5/Splunk-Search/Table-with-Multiple-by-Fields/m-p/515792#M144826 <P>The <FONT face="courier new,courier">chart</FONT> command allows only a single <FONT face="courier new,courier">by</FONT> clause.<BR />Please share the desired output.</P> Mon, 24 Aug 2020 13:35:11 GMT https://community.splunk.com/t5/Splunk-Search/Table-with-Multiple-by-Fields/m-p/515792#M144826 richgalloway 2020-08-24T13:35:11Z