How can I create a report where values are grouped by a subgroup?

[yk010123]

I have the following data : 

Service	Message
Service1	Hello world
Service2	Another message
Service1	Hello world
Service1	Some other message

How can I write a report such that the final output looks like : 

Service

Message : count

For example, with the data above, it should be : 

Service1

Hello world : 2

Some other message : 1

Service 2

Another message : 1

[kamlesh_vaghela]

@yk010123 

Can you please try this?

YOUR_SEARCH
| stats count by Service Message 
| eval dummy=Message.":".count 
| stats list(dummy) As dummy by Service  
| eval value=mvappend(Service,dummy," ")
| mvexpand value
| table value

My Sample Search :

| makeresults 
| eval _raw="Service	Message
Service1	Hello world
Service2	Another message
Service1	Hello world
Service1	Some other message" 
| multikv forceheader=1 
| table Service Message 
| rename comment as "Upto now is for sample data only" 
| stats count by Service Message 
| eval dummy=Message.":".count 
| stats list(dummy) As dummy by Service  
| eval value=mvappend(Service,dummy," ")
| mvexpand value
| table value

 

Thanks
KV


If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[VatsalJagani · Accepted solution]

Try this search:

<your current search>
| stats count by Service, Message

If you want a different format:

<your current search>
| stats count by Service, Message
| eval Message = Message." (".count.")"
| stats list(Message) by Service

I hope this helps!!!