https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266841#M80254 <P>thanks. Appreciate it</P> Mon, 25 Jul 2016 20:36:44 GMT jdepp 2016-07-25T20:36:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266839#M80252 <P>I am trying to display a table that lists specific fields, but also a stats count of one of the fields. It works, but then one of the remaining fields does not display anything.</P> <P>Search String</P> <PRE><CODE>source="/data.cycletimes/tcp/10039" | stats sum(totalPosts) as "Total New Posts" by user | rename startDate as "First Post" | table user, "First Post" ,"Total New Posts </CODE></PRE> <P>In the above all columns display the total except the "First Post" field. Also I would like to group it by user so that each user only appears once.<BR /> I get it to work with this search, but then user appears more than once.</P> <PRE><CODE>source="/data.cycletimes/tcp/10039" | stats sum(totalPosts) as "Total New Posts" by user, startDate | rename startDate as "First Post" | table user, "First Post" ,"Total New Posts" </CODE></PRE> <P>Appreciate any response and help.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1603iE6D2D3D82256239C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 20 Jul 2016 16:25:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266839#M80252 jdepp 2016-07-20T16:25:46Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266840#M80253 <P>Try like this</P> <PRE><CODE>source="/data.cycletimes/tcp/10039" | stats first(startDate) as "First Post" sum(totalPosts) as "Total New Posts" by user </CODE></PRE> Wed, 20 Jul 2016 16:39:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266840#M80253 somesoni2 2016-07-20T16:39:57Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266841#M80254 <P>thanks. Appreciate it</P> Mon, 25 Jul 2016 20:36:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-listing-specific-fields/m-p/266841#M80254 jdepp 2016-07-25T20:36:44Z