How to add the count of two different fields' values?

[i111040d]

For example:

|stats count by src_ip

src_ip count
1.1.1.1 100
2.2.2.2 200
3.3.3.3 300

|stats count by dst_ip

dst_ip count
1.1.1.1 200
2.2.2.2 300
3.3.3.3 400

On these conditions, I wan to create the table

ip_addr count
1.1.1.1 300
2.2.2.2 500
3.3.3.3 700

How can I create the table?

[sundareshr · Accepted solution]

Assuming both fields exist on each event, try this

.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip

[i111040d]

I could do it!
Thanks a lot bro 🙂