status=Auto, Manual
car= BMW, Honda, Audi
index * | stats count(status) as Total by car
Is there anyway I can get the results as shown in attached picture.
For fun, Splunk 9 allows a special mode in foreach that can be used for this purpose.
| stats count as Total by car status
| foreach mode=multivalue status
[eval <<ITEM>> = if(isnull(Total), 0, Total)]
Use chart, not stats
| chart count as Total over car by status