topic search query with table. in Splunk Search

search query with table.

kiran331 — Fri, 01 Jul 2016 19:50:45 GMT

Hi all, I have the fields unit, user, work from the result set:

unit      user     work 
   a     kiran        w
   b    splunk        x
   c       abc        y
   d      cdvv        z

I need these results into

      a          b           c         d
kiran-w    cdvv -z    splunk-x     abc-y

How to get this final table?

woodcock — Fri, 01 Jul 2016 20:12:57 GMT

Just add this to the end:

| eval value=user . "-" . work
| eval ThisFieldIsJunk="junk"
| chart values(value) BY ThisFieldIsJunk unit | fields - ThisFieldIsJunk

vishal_bandavad — Fri, 01 Jul 2016 21:48:17 GMT

Just need little correction in above query . i tried with following query

| eval value=user . "-" . work
| eval ThisFieldIsJunk="junk"
| chart values(value) over ThisFieldIsJunk  by unit unit | fields - ThisFieldIsJunk

Hope this would work

woodcock — Fri, 01 Jul 2016 23:29:11 GMT

These are exactly equivalent (two different command syntax forms that do exactly the same thing).