https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624343#M217076 <P>I performing the chart command for the below kind of table.&nbsp;</P> <P>&nbsp;</P> <P>Command : [|<STRONG>Chart&nbsp; values(course) as course&nbsp; over ID by status</STRONG>]</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_0-1671099564575.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23012i88E5B4FC172E7847/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_0-1671099564575.png" alt="Ashwini_5_0-1671099564575.png" /></span></P> <P>&nbsp;</P> <P>Received Output as BELOW:&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_1-1671099713528.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23013i1425EB762E22D68B/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_1-1671099713528.png" alt="Ashwini_5_1-1671099713528.png" /></span></P> <P>&nbsp;</P> <P>Expected Output :&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_2-1671099792212.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23014iC42CF5D2584B34C7/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_2-1671099792212.png" alt="Ashwini_5_2-1671099792212.png" /></span></P> <P>Kindly help to resolve this . I have tried |MVExpand&nbsp; status also . . But it is picking only the first value and providing wrong output .&nbsp;&nbsp;</P> <P>&nbsp;</P> Thu, 15 Dec 2022 14:44:54 GMT Ashwini_5 2022-12-15T14:44:54Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624343#M217076 <P>I performing the chart command for the below kind of table.&nbsp;</P> <P>&nbsp;</P> <P>Command : [|<STRONG>Chart&nbsp; values(course) as course&nbsp; over ID by status</STRONG>]</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_0-1671099564575.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23012i88E5B4FC172E7847/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_0-1671099564575.png" alt="Ashwini_5_0-1671099564575.png" /></span></P> <P>&nbsp;</P> <P>Received Output as BELOW:&nbsp;</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_1-1671099713528.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23013i1425EB762E22D68B/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_1-1671099713528.png" alt="Ashwini_5_1-1671099713528.png" /></span></P> <P>&nbsp;</P> <P>Expected Output :&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Ashwini_5_2-1671099792212.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23014iC42CF5D2584B34C7/image-size/medium?v=v2&amp;px=400" role="button" title="Ashwini_5_2-1671099792212.png" alt="Ashwini_5_2-1671099792212.png" /></span></P> <P>Kindly help to resolve this . I have tried |MVExpand&nbsp; status also . . But it is picking only the first value and providing wrong output .&nbsp;&nbsp;</P> <P>&nbsp;</P> Thu, 15 Dec 2022 14:44:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624343#M217076 Ashwini_5 2022-12-15T14:44:54Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624534#M217123 <P>Hey&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237432">@Ashwini_5</a> !</P><P>I'm Assuming that both Course and status are multivalve fields.<BR />If my assumption is true the following search should hopefully be able to aid you in finding the solution.</P><LI-CODE lang="markup">| makeresults | fields - _time | eval ID = 1, course = "Course A,Course B,Course C",status="Expired OK Expired" | append [| makeresults | fields - _time | eval ID = 2, course = "Course A,Course B,Course C",status="OK OK Expired"] | append [| makeresults | fields - _time | eval ID = 3, course = "Course A,Course B,Course C",status="OK OK OK"] | fields ID course status | makemv course delim="," | makemv status delim=" " | mvexpand course | eval status=case(course="Course A",mvindex(status,0,0),course="Course B",mvindex(status,1,1),course="Course C",mvindex(status,2,2)) | chart values(status) as status over ID by course</LI-CODE> Fri, 16 Dec 2022 12:30:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624534#M217123 FelixLeh 2022-12-16T12:30:25Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624558#M217124 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237432">@Ashwini_5</a>&nbsp;- Here is fully dynamic query that works with N number of course and status values:</P><LI-CODE lang="markup">| eval combined=mvzip(course, status, "|") | mvexpand combined | eval course=mvindex(split(combined, "|"), 0), status=mvindex(split(combined, "|"), 1) | chart values(status) as status over ID by course</LI-CODE><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="VatsalJagani_0-1671201928367.png" style="width: 647px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23059i42C1418D9E62E6CD/image-dimensions/647x144?v=v2" width="647" height="144" role="button" title="VatsalJagani_0-1671201928367.png" alt="VatsalJagani_0-1671201928367.png" /></span></P><P>&nbsp;</P><P>I hope this helps!!!</P> Fri, 16 Dec 2022 14:45:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-chart-command-with-two-multifield-columns-in-the/m-p/624558#M217124 VatsalJagani 2022-12-16T14:45:45Z