I am trying to get the count of different fields and put them in a single table with sorted count.
stats count(ip) | rename count(ip) as count | append [stats count(login) | rename count(login) as count] | append [ stats count(bcookie) | rename count(bcookie) as count]
I seem to be getting the following output:
count 10 20 30
However, I need the output to be something like this:
name count ip 10 login 20 bcookie 30
Thanks in advance.
You could simply do..
stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.
However, the format of the results table is a little different from what you requested.
I need to construct a pie chart based on these counts.
Your above query will give me the following o/p-
ip login bcookie
20 30 50
Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie
I got it. The following gives the result I am expecting
stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose