Table with Multiple by Fields - Splunk Community

Splunk Search

I have a search that I have been asked to organize in a different way.

Mysearch | rex (FieldA)(FieldB)(FieldC)(FieldD) | chart latest(FieldD),FieldC by FieldB by FieldA

FieldD and FieldC have unique values

There will be multiple FieldD values for each FieldB and multiple FieldB values for FieldA

That will be for the full list, at some point I have been asked to do a relation for the top values of FieldD compared to FieldB as well.

I am a bit lost as to how to proceed with this.

The chart command allows only a single by clause.
Please share the desired output.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...