https://community.splunk.com/t5/Splunk-Search/multiple-stats-count-function-in-the-same-search-component/m-p/473989#M133355 <P>@gcusello <BR /> I have multiple count functions in the same search component. What does it mean by that? What is really happening here?<BR /> | stats count(vendor_action) as ActionEvents, count as TotalEvents</P> <P>I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?</P> Thu, 02 Jan 2020 12:25:19 GMT palisetty 2020-01-02T12:25:19Z https://community.splunk.com/t5/Splunk-Search/multiple-stats-count-function-in-the-same-search-component/m-p/473989#M133355 <P>@gcusello <BR /> I have multiple count functions in the same search component. What does it mean by that? What is really happening here?<BR /> | stats count(vendor_action) as ActionEvents, count as TotalEvents</P> <P>I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?</P> Thu, 02 Jan 2020 12:25:19 GMT https://community.splunk.com/t5/Splunk-Search/multiple-stats-count-function-in-the-same-search-component/m-p/473989#M133355 palisetty 2020-01-02T12:25:19Z https://community.splunk.com/t5/Splunk-Search/multiple-stats-count-function-in-the-same-search-component/m-p/473990#M133356 <P>The first count is counting up the events that have a vendor_action field. The second count is counting up the total number of events.</P> <P>You can use this to calculate a percentage, for example:</P> <PRE><CODE>| stats count(vendor_action) as ActionEvents, count as TotalEvents | eval message="Vendor action events account for ".round(ActionEvents/TotalEvents*100,1)."% of the total volume" </CODE></PRE> Thu, 02 Jan 2020 13:37:31 GMT https://community.splunk.com/t5/Splunk-Search/multiple-stats-count-function-in-the-same-search-component/m-p/473990#M133356 jpolvino 2020-01-02T13:37:31Z