Combining separate columns based on x-axis value

[sepkarimpour]

I initially created a chart that will show log count for a number of hosts: ... | chart count by host source | ... which would show the logs based for each separate host (first image) but I wanted it to only display when the counts don't match.

After some testing, I can produce a table that will display three columns per host when the counts don't match: ... | stats count as num_source by host source | eventstats values(num_source) as num_counts by host | where mvcount(num_counts)>1 | table host num_source | ... (second image), but now it displays the host for each column and are all one colour which isn't clear. Is there a way I can use the chart command so it's similar to the first image but with the data of the second? Thanks.

[DalJeanis · Accepted solution]

...
| stats count as num_source by host source 
| eventstats values(num_source) as num_counts by host 
| where mvcount(num_counts)>1 
| table host source num_source 
| chart sum(num_source) as count by host source