Split Table by Field

[p3hndrx]

Greetings...

I have a table that looks like:

Timestamp | Action | User
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Fail| User2

Is there a way to break this down into separate tables by User such that:
YYYY-MM-DD HH:MM:SS| Fail | User1
YYYY-MM-DD HH:MM:SS| Succeed| User1
YYYY-MM-DD HH:MM:SS| Succeed| User1

YYYY-MM-DD HH:MM:SS | Succeed| User2
YYYY-MM-DD HH:MM:SS| Fail| User2

[to4kawa]

That's right, because it wasn't in the request.

[to4kawa]

index=_internal | head 1 | fields _raw | eval _raw="Timestamp | Action | User
YYYY-MM-DD HH:MM:SS | Fail | User1
YYYY-MM-DD HH:MM:SS | Succeed | User2
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Succeed | User1
YYYY-MM-DD HH:MM:SS | Fail | User2"
| rename COMMENT as "these are your log sample. from here, the logic"
| rex mode=sed "s/( \| )/,/g"
| multikv forceheader=1
| table Timestamp Action User
| sort User
| autoregress User
| streamstats count as tmp
| eval User=mvdedup(mvappend(User,User_p1))
| fields - User_p1
| mvexpand User
| streamstats count by tmp
| sort User
| foreach * [ eval <<FIELD>>=if(count=2,NULL,'<<FIELD>>')]
| table Timestamp Action User

It's not easy to open a line.

[p3hndrx]

This gets me pretty close.

I guess there is no trellis for a stats table.