How to create a table with multiple fields?

[suvi6789]

Hi,

I want to create a table in the below format and provide the count for them.
I have multiple fields in my index and I want to create a table(similar to a excel pivot) using three fields

App Name, Response code and Method 

index=abcd 
| chart count  over App Name by Response code 

--> Above works for me but I can create a table only using 2 fields. 
How to create a table something as below format  with 3 fields or more than 3.

Please could you help. 

APP NAME	RESPONSECODE	RESPONSECODE	RESPONSECODE
200	400	400
GET	POST	PATCH	GET	POST	PATCH	GET	POST	PATCH
APP1
APP2
APP3
APP4
APP5
APP6

[bowesmana · Accepted solution]

I am assuming that you want to get 200, 400 and 500 (not a second 400) response codes.

You can combine the response code and method and then chart by that field, e.g. see this run anywhere example but it is the last two lines you want.

| makeresults count=40
| eval responseCode=mvindex(split("200,400,500", ","), random() % 3)
| eval method=mvindex(split("GET,POST,PATCH", ","), random() % 3)
| eval app="APP".(random() % 5)
``` Use these two lines to get the chart you want ```
| eval s=responseCode."_".method
| chart count over app by s

 It will not give you a multiline header as in your image, but that's not really how Splunk does things in tables.

[suvi6789]

Hi, 
Many thanks for the update. This is helpful. 
I will consider this as a solution 

[suvi6789]

The table pasted has been reformated. I have attached the image of the format that I need.
Please check the attached image