How to count by mvexpand field result

[cowmanchiang]

Now I have a table about id and ip, like this.

ID      IP

AA    1.1.1.1

AA    1.1.1.1

AA    1.1.1.2

AA    1.1.1.3

AA    1.1.1.3

AA    1.1.1.3

BB    1.1.2.1

BB    1.1.2.1

BB    1.1.2.1

Because I want to get the result, it will be sorted by totalcount first, like this

ID     IP             count     totalcount

AA   1.1.1.3       3           6

AA   1.1.1.1       2           6

AA   1.1.1.2       1           6

BB   1.1.2.1       3           3

I use "sourcetype="mail" [search sourcetype="mail" | top id | table id] | stats count, values(ip) by id | sort - count | rename count as totalcount | mvexpand ip | table id, ip, totalcount"

It will get

ID     IP             totalcount

AA   1.1.1.3       6

AA   1.1.1.1       6

AA   1.1.1.2       6

BB   1.1.2.1       3

How to get the count by each id, ip?
Thanks.

[gkanapathy · Accepted solution]

Probably easier to do:

sourcetype="mail" [search sourcetype="mail" | top id | table id] | stats count by id,ip | eventstats count as totalcount by id

[cowmanchiang]

Thanks, it's useful to me.
I also edit it to
sourcetype="mail" [search sourcetype="mail" | top id | table id] | stats count by id,ip | eventstats sum(count) as totalcount by id