I have a search that returns values in a table like this: USER TIME IP Location user1 time1 ip1 loc1 user1 time2 ip1 loc1 user2 time2 ip2 loc2 user1 time3 ip3 loc1 user3 time3 ip4 loc4 user1 time4 ip4 loc1 I want to search by grouped User Counts so I tried something like this: ...| stats Count by User values(User) values(Time) values(IP) values (Location) Which gives me: USER TIME IP Location user1 time1 ip1 loc1 time2 ip3 time3 user2 time2 ip2 loc2 user3 time3 ip4 loc4 user1 time4 ip4 loc1 What I'm really after is: USER TIME IP Location user1 time1 ip1 loc1 time2 ip3 loc1 time3 ip3 loc1 user2 time2 ip2 loc2 user3 time3 ip4 loc4 user1 time4 ip4 loc1 It looks like the stats command decouples the fields and reports the TIME IP and LOC based on a column perspective. I checked around a bit and it looks like evenstats may get me closer, but haven't been able to get it to work either. Can this be done in Splunk? If so, can someone point me in the right direction? Thanks! ... View more