Hi,
I have below output with my search,
base search| stats count by User, action
But i would like the table to display as below
Please Let me know if this is possible
Try something like this
base search| stats count by User, action | eval {action}=count | fields - action | stats values(*) as * by User | addtotals