You need to concatenate the fields, do the stats (well chart to be precise), then split the concatenated field | makeresults count=100 | eval date=strftime(relative_time(now(),"-".(random()%10)."d@d"),"%F") | eval group=mvindex(split("ABC",""),random()%3) | eval state=mvindex(split("InProgress|Declined|Submitted","|"),random()%3) | eval dategroup=date."|".group | chart count by dategroup state | addtotals | eval date=mvindex(split(dategroup,"|"),0) | eval group=mvindex(split(dategroup,"|"),1) | fields - dategroup | table date group * Total ... View more