How to display count of two different fields with different values?

[i471]

Hello all I'm having difficulties figuring out how to output 2 seperate counts for 2 seperate fields.

index=email spf="fail*" OR dkim="fail*"
| dedup message_id
| stats count BY spf, dkim

Atttempting to return a single count of the unique logs that contain spf="fail" and a single count of unique logs that contain dkim="fail" :

spf dkim

14 75

[gcusello]

Hi @i471,
you could try something like this.

index=email spf="fail*" OR dkim="fail*"
| dedup message_id
| eval kind=if(like(spf,"fail%"),"spf",if(like(dkim,"fail%"),"dkim",""))
| search kind!=""
| stats count BY kind

Ciao.
Giuseppe

[i471]

Updated search: index=email spf="fail" OR dkim="fail"