Get a total for a multivalue field by multiple fields

[cquinney]

Greetings,

I'm trying to get multiple totals for multiple fields. My current query incorporates

| stats count as Count by Status StatusTxt, I'm trying to add the total for each StatusTxt to my results.

Status StatusTxt Count
01 Complete 20
02 Complete 25
Total 45
01 Incomplete 10
02 Incomplete 12
Total 22

[cquinney]

I resolved my issue by adjusting my search to look for one value at a time w/ the addcoltotals. Then appended the search again looking for the second value and then created an eval to sort them. Then I sorted off of the eval.

I'm sure there is a more eloquent solution but this was time-sensitive and it got the job done.

[mayurr98]

Try this :

| stats count as Count by Status StatusTxt | eventstats sum(Count) as Total_Count by StatusTxt

It will give you total count for each StatusTxt

If you are only interested in Total count of StatusTxt then you should try:

| stats count as Count by StatusTxt

[Sukisen1981]

@cquinney
This does not look multi valued fields, you have 1 row for each event
why not use |stats sum(Count) by StatusTxt