Stats (count(x) as countX, count(y) as countY) BY FIELD X

[JgTheGreat]

Hi,

As the title suggests, I am after a query which gives me both the values of count(x) and count(y) by fieldX to be used later on in queries.

Is this possible?

Virtual beer and kudos for the best answer.

Kr,

[cmerriman · Accepted solution]

If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same.

Try something like this to get counts when fields equal a certain value:

|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX

Or this to just count how many events are in a field called y and a field called x

|stats count(x) as x_count count(y) as y_count by fieldX