https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523589#M147675 <P>After using mvexpand it's giving me the same output..</P> Thu, 08 Oct 2020 07:00:45 GMT renuka 2020-10-08T07:00:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523582#M147671 <P>I got the output in the form of</P><P>search is : stats values(status) by id..</P><P>Id&nbsp; &nbsp;status</P><TABLE border="1"><TBODY><TR><TD width="100.667px" height="24px">ID</TD><TD width="58px" height="24px">Status</TD></TR><TR><TD width="100.667px" height="17px">1</TD><TD width="58px" height="17px"><P>Agreed</P><P>N/A</P><P>Negoiate</P></TD></TR><TR><TD width="100.667px" height="24px">2</TD><TD width="58px" height="24px"><P>Agreed</P><P>Submitted</P></TD></TR></TBODY></TABLE><P>I want to get the values in different column as given below</P><TABLE border="1" width="69.79346034580932%"><TBODY><TR><TD height="24px">ID</TD><TD height="24px">Status</TD></TR><TR><TD height="24px">1</TD><TD height="24px">Agreed</TD></TR><TR><TD height="24px">1</TD><TD height="24px">N/A</TD></TR><TR><TD height="39px">1</TD><TD height="39px"><P>Negoiate</P></TD></TR><TR><TD width="50%" height="24px">2</TD><TD width="19.806451612903224%" height="24px">Agreed</TD></TR><TR><TD width="50%" height="24px">2</TD><TD width="19.806451612903224%" height="24px">Submitted</TD></TR></TBODY></TABLE><P>&nbsp;For refference i attached the screenshot below..Can you please Suggest me with the&nbsp;</P> Thu, 08 Oct 2020 06:12:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523582#M147671 renuka 2020-10-08T06:12:12Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523584#M147672 <LI-CODE lang="markup">| mvexpand Status</LI-CODE> Thu, 08 Oct 2020 06:32:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523584#M147672 ITWhisperer 2020-10-08T06:32:13Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523585#M147673 <P>Try one of these</P><LI-CODE lang="markup">|stats count by status,id|fields - count</LI-CODE><P>OR</P><LI-CODE lang="markup">|mvexpand status</LI-CODE><P>&nbsp;</P> Thu, 08 Oct 2020 06:34:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523585#M147673 renjith_nair 2020-10-08T06:34:21Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523589#M147675 <P>After using mvexpand it's giving me the same output..</P> Thu, 08 Oct 2020 07:00:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523589#M147675 renuka 2020-10-08T07:00:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523590#M147676 <P>This is great. Anthony Constantinou CWM appreciate your effort.</P> Thu, 08 Oct 2020 07:01:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523590#M147676 anthonyconstant 2020-10-08T07:01:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523598#M147679 <P>Please check the spelling and case of the mvexpand field because it should have worked. If it is still not working, please share your query (preferably in a code block)</P> Thu, 08 Oct 2020 07:10:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523598#M147679 ITWhisperer 2020-10-08T07:10:15Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523607#M147683 <P>I am getting answer by mvexpand DA_status_variant name</P><P>but problem is i have n number of variant names in my data..id i give DA_status_* it is not taking..can y ou suggest for it..so that irrespective of variant name it should expand</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 08 Oct 2020 09:08:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523607#M147683 renuka 2020-10-08T09:08:31Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523608#M147684 <P>What is it that you are hoping to see (for the example in your screenshot)?</P> Thu, 08 Oct 2020 07:38:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523608#M147684 ITWhisperer 2020-10-08T07:38:20Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523610#M147686 <P>Example in screenshot</P><P>I tried by MV expand for status_variantname</P><P>but i have many number of variant names in my data,if i give</P><P>mvexpand Status_*,it is not giving any output,</P><P>Irrespective of variant name i need to expand the values in the fields...</P> Thu, 08 Oct 2020 07:42:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523610#M147686 renuka 2020-10-08T07:42:15Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523630#M147695 <P>It wouldn't work as expected if you have multiple multivalue fields created out of a common field especially if they have different number of items. Ideally you should stitch them together with mvzip and expand later.</P><P>However in your case, of the number of fields are defined, why dont you try</P><LI-CODE lang="markup">|stats count by modulename,field1,field2,field3 etc |fields - count</LI-CODE><P>&nbsp;</P> Thu, 08 Oct 2020 09:17:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523630#M147695 renjith_nair 2020-10-08T09:17:34Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523632#M147696 <P>THANK YOU renjith</P> Thu, 08 Oct 2020 09:24:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-of-one-id-in-different-columns/m-p/523632#M147696 renuka 2020-10-08T09:24:14Z