https://community.splunk.com/t5/Splunk-Search/Looking-for-a-search-to-categorize-by-hosts/m-p/356813#M174843 <P>I am expecting a single search to categorize by hosts with individual count and total count by category...</P> <P>SET-A Count _time<BR /> host=web01 25<BR /> host=web02 55<BR /> SET-A Total 80</P> <P>SET-B Count _time<BR /> host=web05 15<BR /> host=web06 20<BR /> SET-B-Total 35</P> Mon, 01 May 2017 15:11:34 GMT prakash007 2017-05-01T15:11:34Z https://community.splunk.com/t5/Splunk-Search/Looking-for-a-search-to-categorize-by-hosts/m-p/356813#M174843 <P>I am expecting a single search to categorize by hosts with individual count and total count by category...</P> <P>SET-A Count _time<BR /> host=web01 25<BR /> host=web02 55<BR /> SET-A Total 80</P> <P>SET-B Count _time<BR /> host=web05 15<BR /> host=web06 20<BR /> SET-B-Total 35</P> Mon, 01 May 2017 15:11:34 GMT https://community.splunk.com/t5/Splunk-Search/Looking-for-a-search-to-categorize-by-hosts/m-p/356813#M174843 prakash007 2017-05-01T15:11:34Z https://community.splunk.com/t5/Splunk-Search/Looking-for-a-search-to-categorize-by-hosts/m-p/356814#M174844 <P>You can if you have that category column available in the logs OR can be added later (eval-case or lookup etc).</P> <P>e.g.</P> <PRE><CODE>your base search giving fields host, _time | ...some logic to get category field there... | bucket _time span=10m ***assuming you want to bucket time. update as required*** | stats count by _time category host | appendpipe [| stats sum(count) as count by _time category | eval category=category."- Total"] | stats list(host) as host list(count) as count by _time category </CODE></PRE> Mon, 01 May 2017 15:32:10 GMT https://community.splunk.com/t5/Splunk-Search/Looking-for-a-search-to-categorize-by-hosts/m-p/356814#M174844 somesoni2 2017-05-01T15:32:10Z