Hello @emamedov, I ran into a similar problem and found a solution hidden in the splunk archives here. For your use case, try this: eventtype=product-view | stats count by username, productname | stats list(username) as "User Name" list(count) as count by productname | rename productname as "Product Name" Good luck and happy hunting! ... View more