https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228966#M67759 <P>Like this:</P> <PRE><CODE>searchHere | chart count BY account cust_action </CODE></PRE> Sat, 25 Jun 2016 02:39:30 GMT woodcock 2016-06-25T02:39:30Z https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228964#M67757 <P>Hello all,</P> <P>New to Splunk and been trying to figure out this for a while now. Not making much progress, so thought I'd ask the experts. I would like to count events for two fields grouped by another field. </P> <P>Right now, if I run the following command, I get the results I'm looking for, but the way they are being displayed is not exactly how I would like it.</P> <PRE><CODE>searchHere | stats count as total by cust_action, account | stats values(cust_action) AS action, values(total) by account </CODE></PRE> <P>This provides me something like shown below:</P> <PRE><CODE> account action total userA submitted 4 resubmitted 1 userB submitted 1 resubmitted 0 userC submitted 1 resubmitted 3 cancelled 1 </CODE></PRE> <P>What I would like to do is have the column name in the results be the value from cust_action field and put the count below each one by per account</P> <PRE><CODE>account submitted resubmitted cancelled userA 4 1 0 userB 1 0 0 userC 1 3 1 </CODE></PRE> <P>Thanks for the help in advanced.</P> Fri, 24 Jun 2016 15:19:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228964#M67757 splunker1981 2016-06-24T15:19:31Z https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228965#M67758 <P>This should do it</P> <PRE><CODE>searchHere | chart count as total over account by cust_action </CODE></PRE> Fri, 24 Jun 2016 15:25:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228965#M67758 somesoni2 2016-06-24T15:25:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228966#M67759 <P>Like this:</P> <PRE><CODE>searchHere | chart count BY account cust_action </CODE></PRE> Sat, 25 Jun 2016 02:39:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-event-counts-for-multiple-fields-grouped-by-another/m-p/228966#M67759 woodcock 2016-06-25T02:39:30Z