Combine features from both stats and chart command

[cmak]

My fields in this example are (row, column, data and count)

I want to combine the features of this command:

chart sum(count) by row, column

This would make something like :

  column1 column2

row1 2 2
row2 3 1

with

stats sum(count) by row,data

This could create:
sum(count)
row1 data1 1
row1 data2 1
row2 data1 3
row2 data2 4

What I want is the combination:

           column1   column2

row1 data1 1 2
row1 data2 1 2
row2 data1 3 5
row2 data2 4 4

where the columns (column 1 and 2) are dynamic - All possible values of field column

In short, I would like to split by multiple fields, but also create a matrix with another particular field.

I suppose I could also try stats sum(eval(column="column1")), but I cannot find a way sum the count field with an eval statement. if there is a way to do this, I can dynamically generate the query with a long line of sum(eval) statements.

[sideview · Accepted solution]

the xyseries command can turn a stats-style result set into the equivalent chart-style one, but since you can only specify one group-by field (the docs call it an x-field), you have to use eval to glom your unique combinations into a single field, wash it through xyseries, and then split it apart again after.

... | stats sum(count) by row data column | eval combined=row+"_"+data | xyseries combined column sum(count) | eval row=mvindex(split(combined,"_"),0) | eval data=mvindex(split(combined,"_"),1) | fields - combined | fields row data *

xyseries docs: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries

[cmak]

This is great