https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270123#M81280 <P>Here is how you will get the expected output</P> <PRE><CODE>your base search | stats count by state city | stats values(city) as city values(count) as city_count sum(count) as Total by State </CODE></PRE> Fri, 05 Feb 2016 03:08:23 GMT somesoni2 2016-02-05T03:08:23Z https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270122#M81279 <P>Hello, <BR /> Say I wanted to create a table with the fields State, City, City Count, and Total. If I try to use <CODE>|stats values(city) as city, count by State</CODE> <BR /> I get a chart that only lists cities, but does not give their individual total, only the total for State. </P> <P>Is it possible to get my chart to look like this:</P> <PRE><CODE>| STATE | CITY | city_count| Total | |CA | San Jose | 5 | 15 | | | Santa Clara | 10 | | </CODE></PRE> <P>the last table in the answer here shows it better: <A href="https://answers.splunk.com/answers/97676/getting-counts-on-multiple-fields-while-grouping-by-one-of-those-fields.html">https://answers.splunk.com/answers/97676/getting-counts-on-multiple-fields-while-grouping-by-one-of-those-fields.html</A> I don't have an "mcount" field, so is this still possible to get the count of each city there? My table would have srcip as State, malware_type as city, and mcount as the total count of each city. </P> <P>Also, I tried using the solution using chart shown here: <A href="https://answers.splunk.com/answers/215808/how-to-get-stats-count-results-broken-down-per-fie.html?utm_source=typeahead&amp;utm_medium=newquestion&amp;utm_campaign=no_votes_sort_relev">https://answers.splunk.com/answers/215808/how-to-get-stats-count-results-broken-down-per-fie.html?utm_source=typeahead&amp;utm_medium=newquestion&amp;utm_campaign=no_votes_sort_relev</A><BR /><BR /> however that table is a lot harder to follow(it lists each city as its own column).</P> <P>Thank you.</P> Fri, 05 Feb 2016 01:27:12 GMT https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270122#M81279 RecoMark0 2016-02-05T01:27:12Z https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270123#M81280 <P>Here is how you will get the expected output</P> <PRE><CODE>your base search | stats count by state city | stats values(city) as city values(count) as city_count sum(count) as Total by State </CODE></PRE> Fri, 05 Feb 2016 03:08:23 GMT https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270123#M81280 somesoni2 2016-02-05T03:08:23Z https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270124#M81281 <P>Wow, you are awesome. That worked perfectly. Thank you so much!</P> Sun, 07 Feb 2016 18:41:12 GMT https://community.splunk.com/t5/Splunk-Search/stats-table-with-individual-count-and-a-total-count-for-two/m-p/270124#M81281 RecoMark0 2016-02-07T18:41:12Z