https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290004#M87699 <P>thanks for your fast reply.</P> <P>Apologies for not mentioning before, what will be the query if new field name of "serviceType" is to be displayed for every serviceType value. Something like below. </P> <P>servicetype1 servicetype2 servicetype3 servicetype4<BR /> xxx yyy zzz www</P> Tue, 15 Aug 2017 17:39:57 GMT kaushik1218 2017-08-15T17:39:57Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290002#M87697 <P>Below is the example of single request with multiple lines where ServiceType is different.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3388iADAEF4EAECC0CE0B/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Required result to be as below, where Service type is placed into single row with different field names</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3389i48CE52CE2D3CD692/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Happy to take any other suggestions. Thanks in advance</P> Tue, 15 Aug 2017 14:58:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290002#M87697 kaushik1218 2017-08-15T14:58:35Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290003#M87698 <P>Well in your sample output, the field name is same and will not work. If output like below is acceptable, try the query.</P> <P>OUTPUT</P> <PRE><CODE>_time, RequestID SiteID Address senderURI serviceType StatusCode xxx yyy xxx ppp qqqq AnalogueTelevision,Broadband,..othervalues.. statuscodevalue </CODE></PRE> <P>Query</P> <PRE><CODE>..your current search | stats values(serviceType) as serviceType by _time, RequestID SiteID Address senderURI StatusCode | nomv serviceType </CODE></PRE> <P>OR<BR /> OUTPUT</P> <PRE><CODE>_time, RequestID SiteID Address senderURI AnalogueTelevision Broadband DigitalTelevision Telephony StatusCode xxx yyy xxx ppp qqqq yes yes yes yes statuscodevalue </CODE></PRE> <P>Query</P> <PRE><CODE>..your current search | eval temp=_time."#".RequestID."#".SiteID."##".Address."#".senderURI."#".StatusCode | stats count over temp by serviceType | rex field=temp "(?&lt;time&gt;\d+)#(?&lt;RequestID&gt;[^#]+)#(?&lt;SiteID&gt;[^#]+)#(?&lt;Address&gt;[^#]+)#(?&lt;senderURI&gt;[^#]+)#(?&lt;StatusCode&gt;[^#]+)" | fields - temp | rename time as _time| table _time, RequestID SiteID Address senderURI * StatusCode </CODE></PRE> Tue, 15 Aug 2017 17:02:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290003#M87698 somesoni2 2017-08-15T17:02:33Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290004#M87699 <P>thanks for your fast reply.</P> <P>Apologies for not mentioning before, what will be the query if new field name of "serviceType" is to be displayed for every serviceType value. Something like below. </P> <P>servicetype1 servicetype2 servicetype3 servicetype4<BR /> xxx yyy zzz www</P> Tue, 15 Aug 2017 17:39:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-table-where-the-values-of-my-quot-serviceType/m-p/290004#M87699 kaushik1218 2017-08-15T17:39:57Z