https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285216#M176722 <P>Well, the aggregation done on eventstats and the stats just before that is same, so they're kind of redundant. I would just use like this</P> <PRE><CODE>foo=* bar=* | stats count as AmountByClient by bar foo | stats sum(AmountByClient) AS "Total Count" list(bar) as Clients list(AmountByClient) as "Client Count" by foo </CODE></PRE> Fri, 16 Sep 2016 14:52:31 GMT somesoni2 2016-09-16T14:52:31Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285211#M176717 <P>In the following query, I'm trying to display the count of events for each field (bar) from a single field (foo).</P> <PRE><CODE>foo=* bar=* | stats values(bar) as Clients count as Amount by foo | eventstats sum(Amount) as AmountByClient by foo | stats sum(Amount) AS "Total Count", list(foo) as Clients list(AmountByClient) as "Client Count" by bar </CODE></PRE> <P>On each foo field, I can get all the bars and stat the total amount of events for that group of bars, but I will like to get the count for each bar individually.</P> <P>Thanks for the help!</P> Thu, 15 Sep 2016 15:15:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285211#M176717 Yaichael 2016-09-15T15:15:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285212#M176718 <P>How a bout this</P> <PRE><CODE>foo=* bar=* | stats count as Amount by foo bar | eventstats sum(Amount) as AmountByClient by foo | stats sum(Amount) AS "Total Count", list(foo) as Clients list(AmountByClient) as "Client Count" by bar </CODE></PRE> Thu, 15 Sep 2016 15:42:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285212#M176718 somesoni2 2016-09-15T15:42:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285213#M176719 <P>Thanks for the reply, someoni2.</P> <P>Using your answer as reference, I reconfigured my query as follows:</P> <PRE><CODE>foo=* bar=* | stats count as Amount by bar foo | eventstats sum(Amount) as AmountByClient by foo | stats sum(Amount) AS "Total Count" list(bar) as Clients list(AmountByClient) as "Client Count" by foo </CODE></PRE> <P>but each "Client Count" is being reflected as "Total Count". I played around with it, but I'm still getting unwanted results.</P> Thu, 15 Sep 2016 18:57:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285213#M176719 Yaichael 2016-09-15T18:57:58Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285214#M176720 <P>In my query, I'm using bar in the last stats, whereas you're using foo. Try with bar. Or if you want to group by foo in the last, then try like this (swapping bar with foo)</P> <PRE><CODE>foo=* bar=* | stats count as Amount by foo bar | eventstats sum(Amount) as AmountByClient by bar | stats sum(Amount) AS "Total Count", list(bar) as Clients list(AmountByClient) as "Client Count" by foo </CODE></PRE> Thu, 15 Sep 2016 19:45:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285214#M176720 somesoni2 2016-09-15T19:45:59Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285215#M176721 <P>Found the error! I was missing foo in the eventstats command.</P> <P>Thanks for the help!</P> <PRE><CODE>foo=* bar=* | stats count as Amount by bar foo | eventstats sum(Amount) as AmountByClient by bar foo | stats sum(Amount) AS "Total Count" list(bar) as Clients list(AmountByClient) as "Client Count" by foo </CODE></PRE> Fri, 16 Sep 2016 13:13:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285215#M176721 Yaichael 2016-09-16T13:13:04Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285216#M176722 <P>Well, the aggregation done on eventstats and the stats just before that is same, so they're kind of redundant. I would just use like this</P> <PRE><CODE>foo=* bar=* | stats count as AmountByClient by bar foo | stats sum(AmountByClient) AS "Total Count" list(bar) as Clients list(AmountByClient) as "Client Count" by foo </CODE></PRE> Fri, 16 Sep 2016 14:52:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285216#M176722 somesoni2 2016-09-16T14:52:31Z https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285217#M176723 <P>Yeah, you're right.</P> <P>Thanks for the suggestion!</P> Fri, 16 Sep 2016 15:46:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-count-of-events-for-each-field/m-p/285217#M176723 Yaichael 2016-09-16T15:46:24Z