https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154840#M43541 <P>Try this</P> <PRE><CODE>index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause | stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName </CODE></PRE> Wed, 23 Jul 2014 17:30:55 GMT somesoni2 2014-07-23T17:30:55Z https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154839#M43540 <P>I am stuck on creating a search. I need to sort my results by Agency and I need to list a count of all events as well as a count of all events broken down by the values in the Cause field. The search below accomplishes everything except showing the count of the Cause values. </P> <P>index=dspro sourcetype=bootlogmaster force=*| stats values(Cause) count by Agency AgencyName</P> <P>Any help would be greatly appreciated.</P> <P>Thank you,<BR /> Don</P> Wed, 23 Jul 2014 17:22:51 GMT https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154839#M43540 DonDandrea 2014-07-23T17:22:51Z https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154840#M43541 <P>Try this</P> <PRE><CODE>index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause | stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName </CODE></PRE> Wed, 23 Jul 2014 17:30:55 GMT https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154840#M43541 somesoni2 2014-07-23T17:30:55Z https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154841#M43542 <P>That worked perfectly. Thank you very much.</P> Wed, 23 Jul 2014 18:48:50 GMT https://community.splunk.com/t5/Splunk-Search/Search-Help/m-p/154841#M43542 DonDandrea 2014-07-23T18:48:50Z