https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205831#M59858 <P>Try this:</P> <PRE><CODE>your search | eval changes = field2+"-&gt;"+field3 | stats values(changes) as changes by field1 </CODE></PRE> Mon, 07 Sep 2015 11:08:49 GMT diogofgm 2015-09-07T11:08:49Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205830#M59857 <P>field1,field2,field3<BR /> 1, a, b<BR /> 1, b, c<BR /> 1, c, d<BR /> 2, r, s<BR /> 2, s, k<BR /> 2, k, l<BR /> 2, l, m</P> <P>field 1 is the key </P> <P>based on above data, I need to as following manner</P> <P>1 a-&gt;b b-&gt;c c-&gt;d<BR /> 2 r-&gt;s s-&gt;k k-&gt;l l-&gt;m</P> <P>If any one have an idea, please share to me..</P> Mon, 07 Sep 2015 08:07:06 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205830#M59857 sajumulakkal 2015-09-07T08:07:06Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205831#M59858 <P>Try this:</P> <PRE><CODE>your search | eval changes = field2+"-&gt;"+field3 | stats values(changes) as changes by field1 </CODE></PRE> Mon, 07 Sep 2015 11:08:49 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205831#M59858 diogofgm 2015-09-07T11:08:49Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205832#M59859 <P>Thanks diogofgm ... your solution/answer is excellent.. it worked for me...</P> Tue, 08 Sep 2015 02:33:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205832#M59859 sajumulakkal 2015-09-08T02:33:33Z https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205833#M59860 <P>Thanks your solution/answer is excellent. It worked for me..<BR /> once again ... thanks to diogofgm.</P> Tue, 08 Sep 2015 02:35:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-transpose/m-p/205833#M59860 sajumulakkal 2015-09-08T02:35:44Z