How to show multiple field values, that match another field

[jravida]

Hi folks,
I'll do my best to explain this. I'll use cars as an analogy because it is easier to explain:

In my data source I have a field, let's call it Model. Results would include: Ford, Dodge, Lincoln, Honda, etc.

In another field I have Make. It would contain: Mustang, Focus, Charger, Civic, Accord, TownCar, etc.

Right now I have a simple table that would look like this:
Model Make
Civic Honda
Towncar Lincoln
Accord Honda
Mustang Ford
Focus Ford
Charger Dodge

The query is | stats count by Make Model | table Model Make | sort -Model

Rather than having a one-to-one list that has duplicate Makes, I would like to have a line show the Make in one field and list ALL the models, separated by comma, in on field value. So it would look like this:

Make Models
Honda Accord, Civic
Ford Focus, Mustang
Lincoln Towncar
Dodge Charger

Can anyone help me get started with this query?

[somesoni2 · Accepted solution]

Or this

your base search  | stats count by Make Model | table Model Make | stats delim="," values(Model) as Model by Make | nomv Model

[martin_mueller]

Take a look at this run-anywhere example:

index=_internal | stats values(source) as source by sourcetype | eval source = mvjoin(source, ", ")

That will give you a comma-separated list of source (Model) values by sourcetype (Make).