For formatting the code/output, select the text and click on button 101010 available on top of the text box, OR select the text and press Ctrl+K. The expected format you're looking for is like double level row merge in Excel, which I'm afraid is not available in Splunk. So, you can either go with option 2 OR go with option 1 with some customization so that you can segregate the Events. Something like this (see if it helps):- your base search giving fields Sensor_name Work_station Event | stats count by Sensor_name Work_station Event | appendpipe [| stats count by Sensor_name, Work_station | eval Event="*****".Work_station."*****"] | stats values(Work_station) as Work_stations list(Event) as Events by Sensor_name ... View more