Get count of multiple fields in a single column using STATS or any other

[shashank111v]

HI,

I have events in splunk, where two fields description and msg denotes error messages. When I try to use to below. I tried renaming msg and description to same values but I am not getting an count.

index=work  status=failure
| stats count by description
|appendcols
[search index=work tag=error
| stats count by msg]

I  see below result:

Description   Count          msg

                           10              Account locked

Login failed    20

How can I get below?

Error                  Count

Account Locked 10

Login failed           20

[isoutamo · Accepted solution]

Hi

have you tried this https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/ConditionalFunctions#coalesce.28X... before stats?

...
| eval err=coalesce(error,msg)
| stats count by err

r. Ismo