Need help with below Query

[nilbak1]

I am running below Query

| makeresults| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786"| makemv data delim=";" | rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" | fields - _time,data | table Brand,Size,Files| chart values(Size) over Files by Brand

And want result in below format

Files Brand1 Brand2 Brand3
File1 123 789 125

File2 456 124 786

But result is coming as attached in picture. Whats wrong with the Query ?

[nilbak1]

Thanks guys.

All the above suggestions are working on this sample data.
But the first suggestion by @to4kawa worked for my actual data.

The data was in text format only not sure, why other two was not working.

Once again, thanks a lot for your suggestions

Thanks
Nilesh

[to4kawa]

From your result:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data 
| table Brand,Size,Files
| rename COMMENT as "this is your sample , From here , the logic"
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <<FIELD>> = mvindex('<<FIELD>>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files

More efficient:

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";"
| stats count by data
| rex field=data "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields - _time,data,count 
| chart sum(Size) by Files Brand

Hi folks.
Maybe, you want to extract these from JSON.
I create two query, How about these?

[vnravikumar]

Hi

Check this

| makeresults 
| eval data="Brand1,File1,123;Brand1,File2,456;Brand2,File1,789;Brand2,File2,124;Brand3,File1,125;Brand3,File2,786" 
| makemv data delim=";" 
| mvexpand data 
| rex field=data max_match=0 "(?<Brand>\w+\d+),(?<Files>\w+\d+)\,(?<Size>\d+)" 
| fields Brand,Files,Size 
| eval {Brand}=Size 
| fields - Brand, Size | stats values(*) as * by Files

[FrankVl]

Indeed. Key thing here is adding the | mvexpand data. Otherwise you are working with a single row, with multivalued fields, which results in the outcome as per the screenshot.