Count number of field value per source and show as table

[christopheryu]

I have a field named "router" that has multiple values and have three sources. I would like to count the router values for each source and put them in a table.

So the three "source" values are syslogs, enviro and triggers and "router" have multiple values (e.g, ABCD, EFGH, KLMN). I would like to put in a table the total count of distinct "router" value for each source as shown below:

router syslog enviro triggers
ABCD 3 4 8
EFGH 2 5 9
KLMN 3 7 8

thank you in advance!

[niketn · Accepted solution]

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total

[christopheryu]

| appendcols [search | stats count as TOTAL by router] worked by I like yours better as it is faster 🙂 Thank you!

[christopheryu]

this solved it:

| stats count by router source | xyseries router source count

but I would like to add another column that would show the total count, any suggestions?

[493669]

try this:

...|stats values(router) as router values(*)as * by source

[christopheryu]

thank you for response but your suggestion showed all the fields and their values by source router.