Splunk search to group by the field values

[soujanya]

Hi,

I need to assign the values of a field to a new field and group with the new field.

For ex. 

Field-1  Field2

AppA     xxxx

AppA    yyyy

AppA    zzzz

AppB    xxxx

AppB     yyyy

I want to be able to have a stats count with a new field or value for everything that is there with a combination of Field1 and Field2.  i.e in the above result the new search field 3 may be should return 3 and 2 for each apps. 

I was told this might be achieve-able through lookup definitions and tables , but I am new to it. 

Any help will be great. 

[ITWhisperer]

| stats dc(field2) as field3 by field1