https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234853#M69752 <P>Yes you were correct I just had to write and additional stats command with MM included</P> Wed, 23 Sep 2015 23:46:35 GMT raby1996 2015-09-23T23:46:35Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234850#M69749 <P>Basically I would like to run one stats command where i do some arithmetic and correlation based on one grouping, but i would like to display the results using a different grouping, for example I'm run-in my first stats command grouping by bundle, and display those results grouped by Build.</P> <P>Thank you</P> Wed, 23 Sep 2015 23:01:57 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234850#M69749 raby1996 2015-09-23T23:01:57Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234851#M69750 <P>Hi raby1996,</P> <P>The important part is to pass on any needed field for the second <CODE>stats</CODE> by adding it to the first <CODE>stats</CODE>. Try something like this:</P> <PRE><CODE>your base search here | stats .... by bundle, Build .... | stats ... by Build </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 23 Sep 2015 23:10:56 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234851#M69750 MuS 2015-09-23T23:10:56Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234852#M69751 <P>Hmmmm i might be doing something wrong, here is my first stats</P> <P>Base Search</P> <PRE><CODE>| stats values(Group) as Group list("SFI Level") AS LIC2 count list(MTMS) AS MTMS ,list(Build) AS Build list(it2) AS Current_Bundle_Date , list(nowstring) AS Search_Date(Today) , list(TD) AS Difference , sum(TD) AS Sum, by Bundle | eval MM=Sum/30.4 </CODE></PRE> <P>and my second stats which doesn't give me the right MM </P> <PRE><CODE>|stats list(Bundle), list(LIC2),list(Build),list(count), by Group </CODE></PRE> <P>Basically I want to group differently without it affecting my results from the first stats(specifically MM) if that makes sense?<BR /> P.S I apologize I actaully want to group by "Group" i just changed the name in my question to make it less confusing .<BR /> Thank you!</P> Wed, 23 Sep 2015 23:32:01 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234852#M69751 raby1996 2015-09-23T23:32:01Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234853#M69752 <P>Yes you were correct I just had to write and additional stats command with MM included</P> Wed, 23 Sep 2015 23:46:35 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234853#M69752 raby1996 2015-09-23T23:46:35Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234854#M69753 <P>hmm looks like I don't get it; those are two different <CODE>stats by</CODE> so the result will not be the same?!?</P> Wed, 23 Sep 2015 23:47:48 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234854#M69753 MuS 2015-09-23T23:47:48Z https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234855#M69754 <P>If this answers your question, please accept the answer - thanks <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 23 Sep 2015 23:58:07 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-multiple-times/m-p/234855#M69754 MuS 2015-09-23T23:58:07Z