https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327276#M164595 <P>something like this should help if added to the end:</P> <P><CODE>...|eval{Stage}='count'|fields - Stage count|stats values(*) as * by Region Model</CODE></P> Tue, 05 Dec 2017 01:29:09 GMT cmerriman 2017-12-05T01:29:09Z https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327274#M164593 <P>I need some help grouping and transposing some data. The search below gives me the data but now I want to group it and transpose one of the fields with it's data.<BR /> ....<BR /> | stats count by Stage, Model,Region<BR /> | table Region,Model,Stage,count<BR /> | sort Region,Model,Stage</P> <P><STRONG>Region | Model | Stage | count</STRONG><BR /> East | Blue | Phase1 | 5<BR /> East | Blue | Phase2 | 3<BR /> East | Red | Phase1 | 2<BR /> East | Red | Phase2 | 7<BR /> West | Blue | Phase1 | 6<BR /> West | Blue | Phase2 | 9<BR /> West | Red | Phase1 | 7<BR /> West | Red | Phase2 | 8</P> <P>I want it to look like<BR /> <STRONG>Region | Model | Phase1 | Phase2</STRONG> <BR /> East | Blue | 5 | 3<BR /> ........| Red | 2 | 7<BR /> West | Blue | 6 |9<BR /> ........ | Red | 7 | 8</P> <P>Sorry for my table formatting as I was sure how to do it nicely.</P> Mon, 04 Dec 2017 23:09:17 GMT https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327274#M164593 kent_farries 2017-12-04T23:09:17Z https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327275#M164594 <P>Just add this to the bottom:</P> <PRE><CODE>| stats list(*) AS * BY Region </CODE></PRE> Mon, 04 Dec 2017 23:16:17 GMT https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327275#M164594 woodcock 2017-12-04T23:16:17Z https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327276#M164595 <P>something like this should help if added to the end:</P> <P><CODE>...|eval{Stage}='count'|fields - Stage count|stats values(*) as * by Region Model</CODE></P> Tue, 05 Dec 2017 01:29:09 GMT https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327276#M164595 cmerriman 2017-12-05T01:29:09Z https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327277#M164596 <P>Thank you, that did the trick and saved me a bunch of time. I will add this to my toolbox of SPL.</P> Tue, 05 Dec 2017 16:28:44 GMT https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327277#M164596 kent_farries 2017-12-05T16:28:44Z https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327278#M164597 <P>Thanks for the suggestion, while this produced the results it did not transpose the columns.</P> Tue, 05 Dec 2017 16:30:33 GMT https://community.splunk.com/t5/Splunk-Search/Group-results-by-rows-and-columns/m-p/327278#M164597 kent_farries 2017-12-05T16:30:33Z