Hi there,  im pretty new in Splunk, so sorry if it is easy task. I have following example events in my index -  It is a export from the Zabbix monitoring   8/31/23 4:39:31.000 PM { [-] description: mem Heap Memory used groups: [ [+] ] hostname: WMS_Name itemid: 186985 ns: 941726183 tags.application: Memory type: 3 value: 1199488000 } Show as raw text description = mem Heap Memory usedhost = WMS_NAME1 hostname = WMS_NAME1 source = http:its_wms_zabbixvalue = 1199488000 8/31/23 4:39:31.000 PM { [-] description: mem Heap Memory max groups: [ [+] ] hostname: WMS_NAME1 itemid: 186984 ns: 883128205 tags.application: Memory type: 3 value: 8589934592 } Show as raw text description = mem Heap Memory maxhost = WMS_NAME1 hostname = WMS_NAME1 source = http:its_wms_zabbixvalue = 8589934592   Search query:   index="some_index" sourcetype="zabbix:history" hostname="WMS_NAME1" description="mem Heap Memory used" OR description="mem Heap Memory max"| spath "groups{}" | search "groups{}"="Instances/Tests*" | eval ValueMB=value/1024/1024| table _time, hostname, ValueMB     In this case, there are two events - one for java heap memory usage and one for java heap max memory.  Is there any way, how to rename values variable  based on the description in a event and join them in one table under the same time? Or maybe join both events in one? The main goal is to display both values in one graph and be able to monitor long term usage.  I found a way with using multisearch, but it takes too much time in processing and i believe there will be a more simple way.  Thank you in advance for any hint    

Hello, I'm new to Splunk and despite searching extensively on this community site, I was not able to find a solution for what I thought was a rather simple problem. I would like to list, for each field in my index, the list of top 10 values. I've tried different commande with stats values and top, and the following one gives me what's closest, but the output is messy:     index = my_index | multireport [top limit=10 field_1] [top limit=10 field_2] [top limit=10 field_3]     I do get the top values of each field presented in different columns of the output, but also get many empty cells: field_1 field_2 field_3   a top value of field_2     a top value of field_2     a top value of field_2       a top value of field_3     a top value of field_3 a top value of field_1     a top value of field_1       while i would like something like that: field_1 field_2 field_3 a top value of field_1 a top value of field_2 a top value of field_3 a top value of field_1 a top value of field_2 a top value of field_3   a top value of field_2     Has someone any idea how I could cleanup the output, and, ideally, easily loop through the column names so I don't have to write their name manually. Thank!