Query results with field values as column header

[ma_anand1984]

I have following fields
Datacenter, Category(Cat ), Application(APP), Description(Desc).

Datacenter has 10 or more possible values.

Now i want a table like below

First line is header where Datacenter_value1 .... Datacenter_valueN are values of field Datacenter and Count is sum of counts of each Datacenter_value column

Count Datacenter_value1 Datacenter_value2 ..... Datacenter_valueN Cat APP Desc

450     5               23            .....   37      error cycle  frame error


565    16               43            .....   56      info  car    engine ready

[jonuwz · Accepted solution]

Given that you rename the 'Category(Cat)' and other fields to 'Cat' 'APP' and 'Desc' up front

Join the "key" fields together first, like this :

... | eval joined_fields=Cat.";".APP.";".Desc

Then chart

... | chart count over joined_fields by Datacenter

Then add your totals

... | addtotals

Then split up the joined fields again

... | rex field=joined_fields "(?<Cat>.*?);(?<APP>.*?);(?<Desc>.*)"

Finally remove the joined_fields from the output

... | fields - joined_fields