How do you use a variation of the stats command on different fields?

[sxddhxrthx]

I have 3 fields: IPAddress, ServiceStatus, BackupStatus.

ServiceStatus field consists of "Services Fine", "Services Stopped", "Services in Error" values.

The backup consists of "Files Uploaded", "Files Upload Pending", "Error in Backup".

I want to get a distinct number of IP addresses present, along with the number of servers having a particular ServiceStatus and BackupStatus.

Example:
Total Servers: 100
Services Fine: 78
Services Stoppped: 14
Services in Error: 8

I could achieve these results in different Searches in the following way:

.. | dedup IPAddress |  stats dc(IPAddress) as TotalServers 
.. | dedup IPAddress |  stats count by ServiceStatus

However, I want to get them in a single search, since I want them to be a part of a single Dashboard Panel.

How can I achieve this?

[niketn · Accepted solution]

@sxddhxrthx , I hope you have dedup IPAddress because of duplicate records and you want latest ServiceStatus for each IPAddress. Please try out the following search which uses addcoltotal to give the sum of various ServiceStatus as "Total Servers"

<yourCurrentSearch>
| dedup IPAddress 
| stats count by ServiceStatus
| addcoltotal label_field="ServiceStatus" label="Total Servers"
| sort - count

Following is a run anywhere example based on Splunk's _internal index:

index=_internal sourcetype=splunkd 
| stats count by log_level
| addcoltotals labelfield=log_level label="Total Servers"
| sort - count