How to edit my search to reformat results in a table?

[Tim_1]

Hi all,

I'm new to Splunk, and been stuck at trying to format a table of results.

I currently have the a raw results table that looks something like this:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
 1001          (120)                      two
 1001          (120)                      three
 1001          (1)                        one
 1001          (2)                        one
 1002          (1)                        one
...

What I've currently achieved:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
               (1)                        two
               (2)                        three
                                          one
                                          one
 1002          (1)                        one
...

Using the following query:

| stats values(VendorCoOrd) AS VendorCoOrd, values(product_name) AS Products BY VendorID

However, what I want to achieve is this:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
                                          two
                                          three
               (1)                        one
               (2)                        one
 1002          (1)                        one
...

Any advice on how to achieve this result?

Thanks.

[sundareshr]

Try this

| stats values(product_name) AS Products BY VendorID VendorCoOrd

[Tim_1]

Hi @sundareshr

Thanks for the suggestion, but I have tried that before and it only results in the following:

VendorID     VendorCoOrd         Products
 1001          (120)                      one
                                          two
                                          three
 1001          (1)                        one
 1001          (2)                        one
 1002          (1)                        one