How to split count by product by another value?

[maxmukimov]

Hi,  I have the following query: 

| bin _time span=1d | stats count as ProductCount by applysourcetype, product, _time   

| where _time=relative_time(now(), "-d@d") or _time=relative_time(now(), "-8d@d")   

| eval when = if(_time=relative_time(now(), "-d@d"), "(Yesterday)", "(7 Days Ago)")  

| eval "Products Ordered {when}" = ProductCount    

| fields - _time ProductCount  when

| stats  values(*) as * by product , applysourcetype

and I'm getting following output: 

How can make product filed one row for unique product? 

[s2_splunk]

| mvexpand product

at the end of your search should do the trick. mvexpand docs here.

[maxmukimov]

Getting the same results when I added

| mvexpand product

[ITWhisperer]

| stats list(*) as * by product

[maxmukimov]

got this 

[ITWhisperer]

One unique product per row - which is what you said. If this is not what you wanted, perhaps you can give an example of what you were expecting?

[maxmukimov]

From original query I’m getting something like this :

I want to get something like this:

[ITWhisperer]

The standard table view doesn't merge cells across rows. Using stats list(*) as * by product should at least group the fields into multi-value lists which is close to what you want.  If you still want separate rows for the counts, with blank entries in the product column for subsequent rows for the same product, you could use some CSS to hide them. This is a little fiddly to do but possible.