https://community.splunk.com/t5/Splunk-Search/tstats-and-inputlookup/m-p/675557#M231133 <P>My current search is -&nbsp;</P><P>&nbsp;</P><P>| tstats count AS event_count WHERE index=* BY host, _time span=1h<BR />| append [ | inputlookup Domain_Computers | fields cn, operatingSystem, operatingSystemVersion<BR />| eval host = coalesce(host, cn)]<BR />| fillnull value="0" total_events<BR />| stats sparkline(sum(event_count)) AS event_count_sparkline sum(event_count) AS total_events BY host</P><P>How do I get&nbsp;operatingSystem to display in my table?&nbsp; &nbsp;When I add it to the end of my search BY host,&nbsp;operatingSystem my stats break in the table.</P> Fri, 26 Jan 2024 18:33:13 GMT jeradb 2024-01-26T18:33:13Z https://community.splunk.com/t5/Splunk-Search/tstats-and-inputlookup/m-p/675557#M231133 <P>My current search is -&nbsp;</P><P>&nbsp;</P><P>| tstats count AS event_count WHERE index=* BY host, _time span=1h<BR />| append [ | inputlookup Domain_Computers | fields cn, operatingSystem, operatingSystemVersion<BR />| eval host = coalesce(host, cn)]<BR />| fillnull value="0" total_events<BR />| stats sparkline(sum(event_count)) AS event_count_sparkline sum(event_count) AS total_events BY host</P><P>How do I get&nbsp;operatingSystem to display in my table?&nbsp; &nbsp;When I add it to the end of my search BY host,&nbsp;operatingSystem my stats break in the table.</P> Fri, 26 Jan 2024 18:33:13 GMT https://community.splunk.com/t5/Splunk-Search/tstats-and-inputlookup/m-p/675557#M231133 jeradb 2024-01-26T18:33:13Z https://community.splunk.com/t5/Splunk-Search/tstats-and-inputlookup/m-p/675558#M231134 <P>Add the operating system to the list of values returned by <FONT face="courier new,courier">stats</FONT> rather than as one of the group-by options.</P><LI-CODE lang="markup">| stats sparkline(sum(event_count)) AS event_count_sparkline sum(event_count) AS total_events, values(operatingSystem as operatingSystems BY host</LI-CODE><P>&nbsp;</P> Fri, 26 Jan 2024 18:37:01 GMT https://community.splunk.com/t5/Splunk-Search/tstats-and-inputlookup/m-p/675558#M231134 richgalloway 2024-01-26T18:37:01Z