https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105883#M27515 <P>Can't believe I couldn't figure that out. Your a life saver. Thank you very much!! Worked perfectly.</P> Wed, 24 Jul 2013 19:52:10 GMT brentsinawski 2013-07-24T19:52:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105881#M27513 <P>Hi everyone,<BR /> I am trying to create a table that lists multiple policy id's that shows all ports being used according to that policy ID. If I do a "| dedup policy_id | table policy_id dst_port src_port I get only one dst_port and one src_port. I'm looking to do a list of all the policy id with every port that policy id has used in a specific time. Hard to explain I guess.<BR /> I'm looking for</P> <P>policy_id src_port dst_port<BR /> 836 5622 5488 80 66 488 224 etc.</P> <P>Any help would be extremely appreciated.<BR /> Thank you!!</P> Mon, 28 Sep 2020 14:25:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105881#M27513 brentsinawski 2020-09-28T14:25:30Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105882#M27514 <P>You should try using stats with the values function:</P> <PRE><CODE>| stats values(src_port) values(dst_port) by policy_id </CODE></PRE> Wed, 24 Jul 2013 19:36:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105882#M27514 sdaniels 2013-07-24T19:36:05Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105883#M27515 <P>Can't believe I couldn't figure that out. Your a life saver. Thank you very much!! Worked perfectly.</P> Wed, 24 Jul 2013 19:52:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105883#M27515 brentsinawski 2013-07-24T19:52:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105884#M27516 <P>There are a lot of options so it takes some time to see it all. I've seen at least 5%, so far of what Splunk can do.</P> Wed, 24 Jul 2013 19:53:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-multiple-values-in-a-table/m-p/105884#M27516 sdaniels 2013-07-24T19:53:38Z