@hpendela There are a couple of slightly different ways to do this. The first | makeresults
| eval _raw="Status,Count
200,800
404,34
400,20
500,12"
| multikv forceheader=1
| table Status, Count
| eval Count({Status})=Count
| fields - Count
| stats values(Count*) as Count* Take the last 3 lines, which gives exactly your example. This is slightly different in that it does not rename the fields as you want, but achieves the same goal. | makeresults
| eval _raw="Status,Count
200,800
404,34
400,20
500,12"
| multikv forceheader=1
| table Status, Count
| transpose 0 column_name="Count" header_field=Status Just the last line will do this or you can add the next two lines to give the exact same | fields - Count
| foreach * [ rename "<<MATCHSTR>>" as "Count(<<MATCHSTR>>)" ] Hope this helps
... View more