How do I stats different events with the same by clause?

[jip31]

hi

I stats events like this

But my distinct count is wrong because some events have the same site

How to agregate Pb1, Pb2 and Pb3 separatively by site and to have the sum of the site please?

| stats count(eval(cit >= 40)) as Pb1, count(eval(cit2 >= 15)) as Pb2, count(eval(cit3 >= 20)) as Pb3 by site 
| eval Total=Pb1 + Pb2 + Pb3 
| search Total > 10 
| stats dc(site)

[jip31]

I need to distinct count the number of site returnd by cit1, cit2 and cit3

that why I do a stats by site

The problem is that cit1 for example can have the same list of site than cit2

So my need is to distinct count the number of site separatively for cit1, cit2 and cit3 and after this to do a distinct count of these site

[ITWhisperer · Accepted solution]

| eval Pb1=if(cit>=40,1,0)
| eval Pb2=if(cit2 >= 15,1,0)
| eval Pb3=if(cit3 >= 20,1,0)
| stats max(Pb1) as Pb1 max(Pb2) as Pb2 max(Pb3) as Pb3 by site
| stats sum(Pb1) as Pb1 sum(Pb2) as Pb2 sum(Pb3) as Pb3

[ITWhisperer]

It is not clear why this is not giving you what you want. Can you provide an example of the expected result and the events used to get this result?