Splunk Search
Highlighted

How to get a stats count on multiple fields in a table sorted by count?

Explorer

Hi All,

I am trying to get the count of different fields and put them in a single table with sorted count.

stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] | 
append [ stats count(bcookie) | rename count(bcookie) as count]

I seem to be getting the following output:

count 
10
20
30

However, I need the output to be something like this:

 name        count 
 ip          10
 login       20
 bcookie     30

Thanks in advance.
Aditya

0 Karma
Highlighted

Re: How to get a stats count on multiple fields in a table sorted by count?

Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

View solution in original post

Highlighted

Re: How to get a stats count on multiple fields in a table sorted by count?

Explorer

I need to construct a pie chart based on these counts.

Your above query will give me the following o/p-

ip login bcookie
20 30 50

Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie

0 Karma
Highlighted

Re: How to get a stats count on multiple fields in a table sorted by count?

Explorer

I got it. The following gives the result I am expecting

stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose

Highlighted

Re: How to get a stats count on multiple fields in a table sorted by count?

Splunk Employee
Splunk Employee

Glad you figured it out!

0 Karma
Highlighted

Re: How to get a stats count on multiple fields in a table sorted by count?

Explorer

Thanks jluo for your help

0 Karma