https://community.splunk.com/t5/Splunk-Dev/Stats-count-x-as-countX-count-y-as-countY-BY-FIELD-X/m-p/316039#M4340 <P>Hi, </P> <P>As the title suggests, I am after a query which gives me both the values of count(x) and count(y) by fieldX to be used later on in queries. </P> <P>Is this possible?</P> <P>Virtual beer and kudos for the best answer.</P> <P>Kr,</P> Fri, 01 Sep 2017 21:28:47 GMT JgTheGreat 2017-09-01T21:28:47Z https://community.splunk.com/t5/Splunk-Dev/Stats-count-x-as-countX-count-y-as-countY-BY-FIELD-X/m-p/316039#M4340 <P>Hi, </P> <P>As the title suggests, I am after a query which gives me both the values of count(x) and count(y) by fieldX to be used later on in queries. </P> <P>Is this possible?</P> <P>Virtual beer and kudos for the best answer.</P> <P>Kr,</P> Fri, 01 Sep 2017 21:28:47 GMT https://community.splunk.com/t5/Splunk-Dev/Stats-count-x-as-countX-count-y-as-countY-BY-FIELD-X/m-p/316039#M4340 JgTheGreat 2017-09-01T21:28:47Z https://community.splunk.com/t5/Splunk-Dev/Stats-count-x-as-countX-count-y-as-countY-BY-FIELD-X/m-p/316040#M4341 <P>If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same. </P> <P>Try something like this to get counts when fields equal a certain value:</P> <PRE><CODE>|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX </CODE></PRE> <P>Or this to just count how many events are in a field called y and a field called x</P> <PRE><CODE>|stats count(x) as x_count count(y) as y_count by fieldX </CODE></PRE> Fri, 01 Sep 2017 21:36:23 GMT https://community.splunk.com/t5/Splunk-Dev/Stats-count-x-as-countX-count-y-as-countY-BY-FIELD-X/m-p/316040#M4341 cmerriman 2017-09-01T21:36:23Z