Hi all,
I'm new to Splunk, and been stuck at trying to format a table of results.
I currently have the a raw results table that looks something like this:
VendorID VendorCoOrd Products
1001 (120) one
1001 (120) two
1001 (120) three
1001 (1) one
1001 (2) one
1002 (1) one
...
What I've currently achieved:
VendorID VendorCoOrd Products
1001 (120) one
(1) two
(2) three
one
one
1002 (1) one
...
Using the following query:
| stats values(VendorCoOrd) AS VendorCoOrd, values(product_name) AS Products BY VendorID
However, what I want to achieve is this:
VendorID VendorCoOrd Products
1001 (120) one
two
three
(1) one
(2) one
1002 (1) one
...
Any advice on how to achieve this result?
Thanks.
Try this
| stats values(product_name) AS Products BY VendorID VendorCoOrd
Hi @sundareshr
Thanks for the suggestion, but I have tried that before and it only results in the following:
VendorID VendorCoOrd Products
1001 (120) one
two
three
1001 (1) one
1001 (2) one
1002 (1) one