How to compare the count of two fields from different source types ?

[Ombessam]

How can I get the following visualization ?

I've tried the following commands:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| fields field1 field2
| stats count(field1) as Field1, count(field2) as Field2

and I getting the following graph

[Ombessam]

Awesome @livehybrid , Thanks

[livehybrid · Accepted solution]

Hi @Ombessam ,

To get the desired visualisation comparing the counts of field1 and field2, you need to transform the results of your stats command so that the field names become values in one column and the counts become values in another. The transpose command is suitable for this.

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| stats count(field1) as Field1, count(field2) as Field2 
| transpose 
| rename column as FieldName, "row 1" as Count

This structure (FieldName, Count) allows you to configure your bar chart visualization.

You could also achieve this with:

(index="my_index" sourcetype="sourcetype1") OR (index="my_index" sourcetype="sourcetype2")
| eval x="x" 
| stats count(status) as field1, count(bytes) as field2 by x

🌟 Did this answer help you? If so, please consider:

• Adding kudos to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing