https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174558#M50093 <P>Hi Hildoceras,</P> <P>something like this should get you there:</P> <PRE><CODE> ... | stats count(eval(method="POST")) AS post count(eval(method="GET")) AS get count(eval(method="HEAD")) AS head by country | addtotals </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 05 Mar 2014 10:32:37 GMT MuS 2014-03-05T10:32:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174557#M50092 <P>Hi</P> <P>I am looking at access log data with the fields src_ip and method (get, post, head)</P> <P>I have been running the search src_ip="*" | iplocation src_ip | stats count by country</P> <P>this gives me an event count by country.</P> <P>I would like to take this further and also get a count of total events by country and a split per country of get, post and head</P> <P>any help appreciated</P> Mon, 28 Sep 2020 16:02:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174557#M50092 Hildoceras 2020-09-28T16:02:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174558#M50093 <P>Hi Hildoceras,</P> <P>something like this should get you there:</P> <PRE><CODE> ... | stats count(eval(method="POST")) AS post count(eval(method="GET")) AS get count(eval(method="HEAD")) AS head by country | addtotals </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Wed, 05 Mar 2014 10:32:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174558#M50093 MuS 2014-03-05T10:32:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174559#M50094 <P>Worked like a charm many thanks</P> Wed, 05 Mar 2014 10:46:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174559#M50094 Hildoceras 2014-03-05T10:46:09Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174560#M50095 <P>feel free to accept the answer, thanks <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 05 Mar 2014 11:30:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-Stats-count-of-field-values-by-country/m-p/174560#M50095 MuS 2014-03-05T11:30:25Z