https://community.splunk.com/t5/Splunk-Search/How-to-split-stats-command-results-into-rows/m-p/547237#M155151 <P>Is this the sort of thing you are after?</P><LI-CODE lang="markup">index=proxy | stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut by src_host category | stats list(totalBytesIn) as totalBytesIn, list(totalBytesOut) as totalBytesOut, list(category) as category by src_host</LI-CODE> Thu, 08 Apr 2021 16:51:49 GMT ITWhisperer 2021-04-08T16:51:49Z https://community.splunk.com/t5/Splunk-Search/How-to-split-stats-command-results-into-rows/m-p/547232#M155149 <P>I have proxy logs, in which I am interested in 4 fields: the ip address of the user's computer, the category of the site he visits and the total amount of incoming and outgoing traffic for each category. Now I got such a table, but I needed it to be like in the second table on the screenshot. I just can't find a solution, I ask the SPL guru to help me)))<BR />My query:<BR />index=proxy&nbsp;<BR />| stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut, values(category) by src_host</P> Thu, 08 Apr 2021 16:33:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-stats-command-results-into-rows/m-p/547232#M155149 ipoluda 2021-04-08T16:33:53Z https://community.splunk.com/t5/Splunk-Search/How-to-split-stats-command-results-into-rows/m-p/547237#M155151 <P>Is this the sort of thing you are after?</P><LI-CODE lang="markup">index=proxy | stats sum(bytes_in) as totalBytesIn, sum(bytes_out) as totalBytesOut by src_host category | stats list(totalBytesIn) as totalBytesIn, list(totalBytesOut) as totalBytesOut, list(category) as category by src_host</LI-CODE> Thu, 08 Apr 2021 16:51:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-split-stats-command-results-into-rows/m-p/547237#M155151 ITWhisperer 2021-04-08T16:51:49Z