https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386906#M167986 <P>I have two fields, "sender" and "recipient". I want to create a table that lists distinct sender-recipient pairs and the corresponding # of events for each pair. I can't think of how to use stats dc or dedup to do this. Any ideas?</P> Tue, 07 Aug 2018 13:02:42 GMT mgao 2018-08-07T13:02:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386906#M167986 <P>I have two fields, "sender" and "recipient". I want to create a table that lists distinct sender-recipient pairs and the corresponding # of events for each pair. I can't think of how to use stats dc or dedup to do this. Any ideas?</P> Tue, 07 Aug 2018 13:02:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386906#M167986 mgao 2018-08-07T13:02:42Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386907#M167987 <PRE>| stats count by sender recepient </PRE> <P>or </P> <PRE>| eval sender_recepient = sender."-".recepient | stats count by sender_recepient </PRE> Tue, 07 Aug 2018 15:16:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386907#M167987 pradeepkumarg 2018-08-07T15:16:00Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386908#M167988 <P>How about this? This should give you "list of distinct sender-recipient pairs and the corresponding # of events for each pair"</P> <PRE><CODE>YOur current search with field sender and recipient | stats count by sender recipient </CODE></PRE> Tue, 07 Aug 2018 15:17:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-dc-on-2-fields/m-p/386908#M167988 somesoni2 2018-08-07T15:17:07Z