How to Better format to log event so we could expand and then provide metrics

[pavanml]

Hi All. We have a need to log only one event in Splunk for each Case_ID.

However a single case can have multiple problems and solutions entered by the user in our Website. And based on event in Splunk we need to publish some metrics in the dashboard. Need suggestion for better way to log Problem solution combination in a single event for a case_id; which can help regenerate the table format within Splunk using query effectively to further populate the dashboard metrics shown in below screenshots. Please assist.

[pavanml]

Hi.. The first image pretty much explains about the data and the way we want to log the values for each case_id having multiple problems and solutions.
Looking for a format or structure to log pairwise combination of all the problems and its corresponding solutions w.r.t each case as one event, so that we can still unpack the table as shown in the second image. From which the dashboard metrics in the third image could be generated.
And as only onetime processing occur for each case we might not get multiple events on same case. Even though, we do maintain a date value as well in the event, so that the latest event can be considered in case of multiple events on same case.

[ITWhisperer]

Not sure what the ask is here.

Do you want to know how to parse your existing (proposed?) log format from the first graphic, in order to be able to generate the tables in the other graphics?

Or, do you want suggestions about the log format you might use (in place of the format in the first graphic)?

Also, if you are going to stick with the format in the first graphic, does your website generate a new event for each case when a new solution to an existing or new problem is identified for a case and therefore do your events have a timestamp so that only the latest event for each case can be considered?