Problem with multiple rows in a table (extended statistic)

[C_Sparn]

Hello,

I'm looking for a possibility to create a statistic like this one:

directupload.net/file/d/3630/jzf8nu84_png.htm

Is that possible with the splunk search language?
Greetings

[martin_mueller · Accepted solution]

That looks a lot like a stats count by Date Type User - it'll fill those empty cells as well, but that's cosmetic... and could be fixed in post.

[martin_mueller]

You can add such sub-summary columns like this:

... | eventstats sum(count) by Date Type

For removing duplicate Date values you can do this:

... | streamstats current=f window=1 last(Date) as last_date | eval Date = if(Date == last_date, null, Date) | fields - last_date

It'll copy over the value from the previous row and discard the cell if it's equal to that.

[C_Sparn]

All in all you are right with grouping by multiple fields!
Now I get 1 row foreach time and all cells filled.
But how can I fix that "cosmetic" issue in post?
And is it possible to add another column at the end that has just:

count(time) by Date Type

If I use appendcols with this count it appends the values at the wrong rows beginning at first row!

Thanks for help