How do I show more fields after the stats count by command?

[jcolon68]

I need to add more columns to a search after results are counted. Here's my query

index=wineventlog EventCode=4740 host=* | stats count by Account_Name | sort - count

Results give me Account_Name and Count ...I want to add more fields to results.I tried table but this doesn't work.

[somesoni2]

What's your requirement here? Could you please provide available fields and sample expected
output?

[mkolkebeck]

You could try using the eventstats command instead of stats.

Per Splunk Docs,

The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats

[mtranchita]

When you pipe to stats you are doing a transforming search and in effect dropping the data that isn't part of the statistical results.
In order to include additional fields you need to include them as part of the results. You could also try something like appendpipe to add more output to your base search.

References:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutreportingcommands
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Appendpipe

[Vijeta]

@jcolon68 try below

index=wineventlog EventCode=4740 host=* | stats values(*) as * , count by Account _Name|sort 0 count

[jcolon68]

Thanks! I tried that , but the count is not correct. It's only showing count as 1 for most of the results when there's multiple.

[aguthrie1190]

When you do count by, stats will count the times when the combination of fields appears together, otherwise it will throw away the field if it is not specified in your by argument.

Say you have this data

1 host=host1 field="test"
2 host=host1 field="test2"

And my search is:
* | stats count by host field

I'll have 2 results, each with the count of 1. One result for host1, test and one result for host1, test2.

What does your data look like, if you have a lot of unique events, stats may not be the best way to characterize your data.

[jcolon68]

I just really want to group the Account_Name field into individual lines with a count. But I want to see multiple fields, like Computer Name , which may be different for example:

Account_Name Computer name IP
account Computer 1 10.10.0.1
account Computer 2 10.10.0.2
account Computer 3 10.10.0.3

what I'd like to see is just a grouping and count of "Account_Name" and show other fields as well:

Account_Name Computer name IP Count
account Computer 1 10.10.0.1 3
account Computer 2 10.10.0.2 3
account Computer 3 10.10.0.3 3

[khiott]

index=wineventlog EventCode=4740 host=* | stats count by Account_Name, Computer_Name, IP | stats list(Computer_Name) as Computer_Name, list(IP) as IP, count(Account_Name) as Count by Account_Name | sort - Count

@jcolon68, this groups Account_Names together and still counts them. 

[mtranchita]

So you want to count the account names by multiple fields while still showing the account name?
Have you tried something like:
index=wineventlog EventCode=4740 host=* | stats c(Account_Name) as COUNT by Account_Name, ComputerName, IP

[aguthrie1190]

index=wineventlog EventCode=4740 host=* | stats count by Account_Name Field1 Field2 | sort - count

That should add Field1 and Field2 to your results