https://community.splunk.com/t5/Splunk-Search/Output-of-inner-query-is-returned-in-a-single-line/m-p/376237#M195780 <P>Hi Friends,</P> <P>Apologies for my ignorance, but I have a problem formatting the output of the result from a sub-query.</P> <P><STRONG>index=* "[92929292]" <BR /> | stats values(CALLGUID) as CALLGUID by _time</STRONG>_ <STRONG>| dedup CALLGUID| mvexpand CALLGUID<BR /> | join CALLGUID [ search index=* CALLGUID=* <BR /> | rex "D](:|\s-)(?<SIP_CALL_ERROR>[^,|.]+)" | stats count by CALLGUID error <BR /> | stats list(error) list(count) as count by CALLGUID]<BR /> | fields _time,CALLGUID,errors,count</SIP_CALL_ERROR></STRONG>_</P> <P>I’m working on the above query and I get the results as attached as actualoutput.png and desired_output.png</P> <P>Could anyone please suggest how to make it work <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7297i40C3829A196FEF6C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7298i94870092F408F094/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 11 Jul 2019 03:31:58 GMT kavyadekkata 2019-07-11T03:31:58Z https://community.splunk.com/t5/Splunk-Search/Output-of-inner-query-is-returned-in-a-single-line/m-p/376237#M195780 <P>Hi Friends,</P> <P>Apologies for my ignorance, but I have a problem formatting the output of the result from a sub-query.</P> <P><STRONG>index=* "[92929292]" <BR /> | stats values(CALLGUID) as CALLGUID by _time</STRONG>_ <STRONG>| dedup CALLGUID| mvexpand CALLGUID<BR /> | join CALLGUID [ search index=* CALLGUID=* <BR /> | rex "D](:|\s-)(?<SIP_CALL_ERROR>[^,|.]+)" | stats count by CALLGUID error <BR /> | stats list(error) list(count) as count by CALLGUID]<BR /> | fields _time,CALLGUID,errors,count</SIP_CALL_ERROR></STRONG>_</P> <P>I’m working on the above query and I get the results as attached as actualoutput.png and desired_output.png</P> <P>Could anyone please suggest how to make it work <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7297i40C3829A196FEF6C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7298i94870092F408F094/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 11 Jul 2019 03:31:58 GMT https://community.splunk.com/t5/Splunk-Search/Output-of-inner-query-is-returned-in-a-single-line/m-p/376237#M195780 kavyadekkata 2019-07-11T03:31:58Z