Hi All,
I am trying to get the count of different fields and put them in a single table with sorted count.
stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] |
append [ stats count(bcookie) | rename count(bcookie) as count]
I seem to be getting the following output:
count
10
20
30
However, I need the output to be something like this:
name count
ip 10
login 20
bcookie 30
Thanks in advance.
Aditya
You could simply do..
stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.
However, the format of the results table is a little different from what you requested.
I have a similar usecase all though a little extra is needed...I need count by bcookie and ip.
Then
stats count(ip) as ip by ip, count(bcookie) as bcookie by bcookie
is not working 😞
You could simply do..
stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.
However, the format of the results table is a little different from what you requested.
I need to construct a pie chart based on these counts.
Your above query will give me the following o/p-
ip login bcookie
20 30 50
Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie
I got it. The following gives the result I am expecting
stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose
Glad you figured it out!
Thanks jluo for your help