Field results as table column headings

[Drainy]

A quick example;

Program Name    2.04.0  2.4.3   3.4.24  4.53.5  9
Word            2       1       0       1
Excel           1       2       2       1   
IE              0       0       0       0       1
ETC

The above example was something I produced completely by accident when experimenting with searches to solve a different problem, looking back now I realise that I can actually use this.
What I have done is performed a search on two fields, program_name and program_version. With the resultant data I have managed to construct a table where the version fields found form the headings for each column.
The program name forms each row with a count of how many occurrences of that program name which has the corresponding program version.
Firstly I did try going back through the history but this didn't produce anything of use and I have been since experimenting endlessly with different combinations of stats commands to try and re-produce - any pointers/nudges or help would be appreciated.

[techytanzy]

@Drainy 

Its been decade, but if possible can you pls share how did you achieve this - "What I have done is performed a search on two fields, program_name and program_version. With the resultant data I have managed to construct a table where the version fields found form the headings for each column."

I am trying to get same thing- https://community.splunk.com/t5/Splunk-Search/How-to-add-extracted-fields-name-as-first-column-value...

Thanks

[Ayn · Accepted solution]

The chart command could be used to be achieve this. By giving chart two fields to split the results by, it will output a table like the one you show in your question where the columns are made up from the distinct values of the first field, and the rows are correspondingly made up from the distinct values of the second field. So, using the field names program_name and program_version this will give you the table you want:

<yourbasesearch> | chart count by program_name,program_version