How to compare the count of two fields from different source types ?

Ombessam — Tue, 01 Apr 2025 17:20:16 GMT

How can I get the following visualization ?

I've tried the following commands:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2") | fields field1 field2 | stats count(field1) as Field1, count(field2) as Field2

and I getting the following graph

Re: How to compare the count of two fields from different source types ?

livehybrid — Tue, 01 Apr 2025 19:53:17 GMT

Hi @Ombessam ,

To get the desired visualisation comparing the counts of field1 and field2, you need to transform the results of your stats command so that the field names become values in one column and the counts become values in another. The transpose command is suitable for this.

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| stats count(field1) as Field1, count(field2) as Field2 
| transpose 
| rename column as FieldName, "row 1" as Count

This structure (FieldName, Count) allows you to configure your bar chart visualization.

You could also achieve this with:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2") | eval x="x" | stats count(status) as field1, count(bytes) as field2 by x

🌟 Did this answer help you? If so, please consider:

Adding kudos to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: How to compare the count of two fields from different source types ?

Ombessam — Tue, 01 Apr 2025 20:32:30 GMT

Awesome @livehybrid , Thanks

topic Re: How to compare the count of two fields from different source types ? in Dashboards & Visualizations

How to compare the count of two fields from different source types ?

Re: How to compare the count of two fields from different source types ?

Re: How to compare the count of two fields from different source types ?