How to do eval and stats on fields with many values

[mundus]

Let's say I have logs that look like: date,USER=Joe,ACTION=Open,RESULT=Success

If there are four different types of actions and I want to count the total number of actions by user, I would write a search like:

sourcetype=test.log | stats count(eval(ACTION="Open")) AS Open, count(eval(ACTION="Close")) AS Close, count(eval(ACTION="Read")) AS Read, count(eval(ACTION="Write")) AS Write by DATE,USER | table DATE,USER,Read,Write,Open,Close

What if there are 50 different values for ACTION? Would I have to write a monsterous search string to catch them all or is it possible to count each unique ACTION and save the count in a field with the same name as the action?

Thx.

Craig

[Ayn]

All stats command supports splitting up stats by values like this using the by operator:

sourcetype=test.log | stats count by ACTION

[gkanapathy]

I this particular case, they want ... | stats count by DATE,USER,ACTION. chart is also an option, but would require some eval to combine and split DATE and USER