https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/624603#M217136 <P>Thanks for your prompt reply.<BR />Sorry for the late reply as I was out of town. The solution is working fine for me.<BR /><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;</P> Fri, 16 Dec 2022 20:00:52 GMT mnj1809 2022-12-16T20:00:52Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/622862#M216552 <P>Hello,<BR /><BR />I've the following tabular formatted data:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="mnj1809_0-1669922038675.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/22757i9F6CF247DB7EBA60/image-size/medium?v=v2&amp;px=400" role="button" title="mnj1809_0-1669922038675.png" alt="mnj1809_0-1669922038675.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">mnj1809_0-1669922038675.png</span></span></P> <P>How can I achieve the following:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="mnj1809_1-1669922122511.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/22758i37207675488CAEF5/image-size/medium?v=v2&amp;px=400" role="button" title="mnj1809_1-1669922122511.png" alt="mnj1809_1-1669922122511.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">mnj1809_1-1669922122511.png</span></span></P> <P>Thanks in advance for your help.<BR /><BR /><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a></P> Fri, 02 Dec 2022 14:23:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/622862#M216552 mnj1809 2022-12-02T14:23:54Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/622932#M216563 <P>Like this</P><P>Your search...<BR />| stats list(country) as country list(count) as count by category region<BR />| eventstats sum(count) as byRegion by category region<BR />| eventstats sum(byRegion) as byCategory by category<BR />| table category region country count byRegion byCategory</P> Fri, 02 Dec 2022 01:07:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/622932#M216563 bowesmana 2022-12-02T01:07:21Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/624603#M217136 <P>Thanks for your prompt reply.<BR />Sorry for the late reply as I was out of town. The solution is working fine for me.<BR /><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367">@bowesmana</a>&nbsp;</P> Fri, 16 Dec 2022 20:00:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-tabular-data-to-a-specific-format/m-p/624603#M217136 mnj1809 2022-12-16T20:00:52Z