How to group by multiple fields?

New Member

I have following splunk fields


State can have following values InProgress|Declined|Submitted

I like to get following result

Date.          Group. TotalInProgress.  TotalDeclined TotalSubmitted. Total
12-12-2021       A.     13.              10               15           38

I couldn't figured it out. Any help would be appreciated

Labels (1)
Tags (3)
0 Karma


You need to concatenate the fields, do the stats (well chart to be precise), then split the concatenated field

| makeresults count=100
| eval date=strftime(relative_time(now(),"-".(random()%10)."d@d"),"%F")
| eval group=mvindex(split("ABC",""),random()%3)
| eval state=mvindex(split("InProgress|Declined|Submitted","|"),random()%3)

| eval dategroup=date."|".group
| chart count by dategroup state
| addtotals
| eval date=mvindex(split(dategroup,"|"),0)
| eval group=mvindex(split(dategroup,"|"),1)
| fields - dategroup
| table date group * Total
0 Karma


Edited: Bad first response. You can do this with two stats 


| stats count by Date Group State
| eval "Total{State}"=count
| fields - State count
| stats values(*) as * by Date Group
| addtotals



0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...