https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502476#M46137 <P>hi, Can you elaborate your question . <BR /> But for start if you want to count multiple fields then you can use like<BR /> <CODE>|timechart count as Total, count(eval(status=success)) as Success, count(eval(field=A)) as FieldATotal</CODE> .<BR /> You can also use stats instead of timechart .</P> <P>If you want to count no of events from 2 different queries , then try <BR /> <CODE>Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total</CODE>.</P> <P>Let us know if you are looking something else here.<BR /> Thanks <BR /> Anantha.</P> Wed, 16 Oct 2019 17:20:14 GMT Anantha123 2019-10-16T17:20:14Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502475#M46136 <P>Hi All,<BR /><BR /> I am trying to display the events of the "count"(which is of multiple fields), how do I do that?<BR /> I am using the append/appendcol command to combine 2 queries and display its count. when I click the "count" it is taking me to the same query.</P> Wed, 16 Oct 2019 16:15:25 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502475#M46136 mmengu416 2019-10-16T16:15:25Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502476#M46137 <P>hi, Can you elaborate your question . <BR /> But for start if you want to count multiple fields then you can use like<BR /> <CODE>|timechart count as Total, count(eval(status=success)) as Success, count(eval(field=A)) as FieldATotal</CODE> .<BR /> You can also use stats instead of timechart .</P> <P>If you want to count no of events from 2 different queries , then try <BR /> <CODE>Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total</CODE>.</P> <P>Let us know if you are looking something else here.<BR /> Thanks <BR /> Anantha.</P> Wed, 16 Oct 2019 17:20:14 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502476#M46137 Anantha123 2019-10-16T17:20:14Z https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502477#M46138 <P>HI Anantha, <BR /> Thank you for the response, <BR /> yes, that is the query I am using. Assume I am using the query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total" When I want to triage the "Total" events and click on the "Total" in Splunk, instead of displaying the events, it is taking me to the same query in another tab. the "Total" field does not provide the total events instead it is taking me to the same query "Query1 | stats count as total1 | append[search Query2 | stats count as total2] | eval Total=total1+total2 | table Total."</P> Mon, 21 Oct 2019 12:18:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/how-to-display-the-events-for-the-Count/m-p/502477#M46138 mmengu416 2019-10-21T12:18:21Z