https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695163#M236413 <P>I want to get below in single query</P><P>1. dc of field1 overall</P><P>2. dc of field2 by field1</P> Sat, 03 Aug 2024 17:57:45 GMT Pathik 2024-08-03T17:57:45Z https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695162#M236412 <P>I want to get below in single query</P><P>1. dc of field1 overall</P><P>2. dc of field2 by field1</P> Sat, 03 Aug 2024 17:58:31 GMT https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695162#M236412 Pathik 2024-08-03T17:58:31Z https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695163#M236413 <P>I want to get below in single query</P><P>1. dc of field1 overall</P><P>2. dc of field2 by field1</P> Sat, 03 Aug 2024 17:57:45 GMT https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695163#M236413 Pathik 2024-08-03T17:57:45Z https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695164#M236414 <LI-CODE lang="markup">| eventstats dc(field1) as dc_field1 | stats dc(field2) as dc_field2, max(dc_field1) by field1</LI-CODE> Sat, 03 Aug 2024 18:52:41 GMT https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695164#M236414 richgalloway 2024-08-03T18:52:41Z https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695179#M236416 <P>exactly the way I wanted... thanks a ton</P> Sun, 04 Aug 2024 14:44:23 GMT https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695179#M236416 Pathik 2024-08-04T14:44:23Z https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695182#M236418 <P>If your problem is resolved, then please click the "Accept as Solution" button to help future readers.</P> Sun, 04 Aug 2024 16:49:43 GMT https://community.splunk.com/t5/Splunk-Search/Stuck-in-writing-complex-query/m-p/695182#M236418 richgalloway 2024-08-04T16:49:43Z