Expand multivalue field to show subtotals.

[jdlocklin526]

Hi Everyone,

I have a query that produces table 1 below.

| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group

I'd like to make the table more useful by reflecting it as table 2 and 3.

I tried :
| from inputlookup:"incident.csv" | where caused_by >= " "
| stats count values(caused_by) by assignment_group
| mvexpand values(caused_by)

but it did not give the desired results.

Any help would be appreciated.

[to4kawa · Accepted solution]

| from inputlookup:"incident.csv" 
| where caused_by >= " "
| stats count by assignment_group caused_by
| stats list(caused_by) as caused_by list(count) as count sum(count) as "total team x team" by assignment_group

[jdlocklin526]

Thank you. That works perfectly.