Group by a single field

[aiah]

There is this CSV:

user, application, string  
user1, app1, "abcd"  
user2, app2, "222defg"  
user1, app2, "defg"  
user1, app1, "123ks"  
user2, app3, "111abcd"

I would like the result to look like that:

user1, app1, "abcd"  
       app2, "defg"  
       app1, "123ks"  
user2, app3, "111abcd"  
       app2, "222defg" 

I tried this query (and switched to stats list, also):

 ... | table user app string | stats values(app) as app,  values(string) as string  by user

But it does not keep the formation of the rows. values and list returns a collection of object with no connection to their original event.

An extra question - is there a way to mark the user field (bold/show it as header of a group of events, anything else?)

Thanks!

[somesoni2 · Accepted solution]

Just use stats list instead of stats values.

[aiah]

I thought I tried that already, but now it works. Thanks!

[MuS]

Hi aiah,

did you try to add a by user to your search like this:

 ... | stats values(application) as application,  values(string) as string by user

this should do the job.

Regarding the header, maybe this can be done by some css customizing but I cannot tell you that for sure.

hope this helps ...

cheers, MuS

[aiah]

Oops, a bad copy paste. What I described above was when I used 'by user' at the end of the search. The 'columns' are a bunch of values with no connections between the columns.
For some reason I can't edit my original post...