How to get a stats count on multiple fields in a table sorted by count?

[adicoza786]

Hi All,

I am trying to get the count of different fields and put them in a single table with sorted count.

stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] | 
append [ stats count(bcookie) | rename count(bcookie) as count]

I seem to be getting the following output:

count 
10
20
30

However, I need the output to be something like this:

 name        count 
 ip          10
 login       20
 bcookie     30

Thanks in advance.
Aditya

[manideeplanka]

I have a similar usecase all though a little extra is needed...I need count by bcookie and ip.

Then
stats count(ip) as ip by ip, count(bcookie) as bcookie by bcookie
is not working 😞

[jluo_splunk · Accepted solution]

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

[adicoza786]

I need to construct a pie chart based on these counts.

Your above query will give me the following o/p-

ip login bcookie
20 30 50

Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie

[adicoza786]

I got it. The following gives the result I am expecting

stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose

[jluo_splunk]

Glad you figured it out!

[adicoza786]

Thanks jluo for your help