Thanks @ITWhisperer  Is there any way to rename "_time" to "Last Update" without changing how the date format looks? ... View more

Majority of rows are fixed however it has given me a warning - values are now single but one row is showing weird output. "'stats' command: limit for values of field 'Version' reached. Some values may have been truncated or ignored." Also one of the rows used to look like this: Now it looks like this:   @ITWhisperer  ... View more

This is without filtering the artefact @ITWhisperer    ... View more

I've added a picture with one type of artefact filtered. Let me know if you need text values instead of a picture. @ITWhisperer      ... View more

  Hi @ITWhisperer  Thank you for your response! However, this did not work. Screenshot is from the dynamically generated columns.  ... View more

I can't thank you enough for all the effort you put into that.  However would it be possible to create something like the picture I've posted.  ... View more

Good spot, cheers ... View more

Hi @tscroggins  Thanks for the answer! It works when the rename label is one word however when there are whitespaces, it doesn't seem to work. E.g. | rename _time as "Latest Log Timestamp" | fieldformat 'Latest Log Timestamp'=strftime(t, "%F %T") ... View more

Hi @ITWhisperer  This solution was working a few weeks ago, however I altered the query to create the table from the search function instead of the pivot table function , and now its not working. New Query: | makeresults | eval _raw="Environment,Application,CartridgeType,Cartridge,Version SVP,A-1,User,Alpha,1.4 SVP,A-1,Product,Beta,1.5 SVP,A-1,System,Sigma,1.5 SVP,A-2,User,Alpha,1.4 SVP,A-2,Product,Beta,1.5 SVP,A-2,System,Sigma,1.5 SVP,A-3,User,Alpha,1.4 SVP,A-3,Product,Beta,1.4 SVP,A-3,System,Sigma,1.5 " | multikv forceheader=1 | table Environment, Application, CartridgeType, Cartridge, Version | eval {Environment}:{Application}=Version | fields - Environment, Application, Version | stats values by CartridgeType, Cartridge | rename values(*) as * Adding the "RED" insertion by combining previous answer: | makeresults | eval _raw="Environment,Application,CartridgeType,Cartridge,Version SVP,A-1,User,Alpha,1.4 SVP,A-1,Product,Beta,1.5 SVP,A-1,System,Sigma,1.5 SVP,A-2,User,Alpha,1.4 SVP,A-2,Product,Beta,1.5 SVP,A-2,System,Sigma,1.5 SVP,A-3,User,Alpha,1.4 SVP,A-3,Product,Beta,1.4 SVP,A-3,System,Sigma,1.5 " | multikv forceheader=1 | table Environment, Application, CartridgeType, Cartridge, Version | eval {Environment}:{Application}=Version | fields - Environment, Application, Version | stats values by CartridgeType, Cartridge | rename values(*) as * | fields - _* linecount | foreach * [| eval value=if("<<FIELD>>"=="CartridgeType" OR "<<FIELD>>"="CartridgeName", value, if(isnull(value),'<<FIELD>>',mvappend(value,'<<FIELD>>')))] | eval value=mvdedup(value) | foreach * [| eval <<FIELD>>=if("<<FIELD>>"="value", '<<FIELD>>', if(mvcount(value)=1,'<<FIELD>>',mvappend('<<FIELD>>',"RED")))] | fields - value  Any help would be greatly appreciated! ... View more

too fast, cheers! ... View more

thank you, we are so close! @cmtri  Your solution solves the line issue however now each of the dynamic columns have 'values' at the front: E.g. 'values(SVP:A-1)' . Is there a way to remove the brackets and the 'values' prefix, so it goes back to being 'SVP:A-1' and so on for all the dynamically created columns? ... View more

Hi @cmtri Thought it was working, but there is slightly one more issue.  This is what I entered,  | makeresults | eval _raw="Environment,Application,CartridgeType,Cartridge,Version SVP,A-1,User,Alpha,1.4 SVP,A-1,User,Sigma,1.5 SVP,A-2,Product,Beta,1.2 SVP,A-3,System,Gamma,1.5 SVP,A-2,User,Alpha,1.5" | multikv forceheader=1 | table Environment, Application, CartridgeType, Cartridge, Version | eval {Environment}:{Application}=Version | fields - Environment, Application, Version Line 1 and 5 of the resulting table should be combined together - meaning that since it has the same cartridgetype and cartridge, it should be on one line.  However, the result is producing it as seperate rows. Also, thanks for your help so far! ... View more

This seems to work! Seems like the issue was not including version in the table clause. ... View more

Still is showing only CartridgeType and Cartridge fields.  ... View more

The table is only showing the CartridgeType, Cartridge fields however isn't showing the dynamic fields after it. ... View more

Hi @cmtri  Thanks for your answer but I'm still a little confused. The following doesn't seem to be working? index="main" sourcetype="data"  | eval {Environment}:{Application}="Version" | table CartridgeType Cartridge {Environment}:{Application} ... View more

Hi @ITWhisperer , I'm a little bit confused with what the $ does here, would you mind giving it a quick explanation? ... View more