How to use the stats command to get the sums of 3 fields and the count of sessions IDs by user in one table?

[lmaclean]

So far I have the stats for calculating Total, Upload & Download Bandwidths by user, but then I also want to get a count of session IDs (sessionid) on the same table.:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

I have tried adding a count(sessionid) to the mix, but it doesn't work and returns a "0" for that field and if I try it by itself stats count by sessionid, I get the sessionid which is just a high number then a count of "1".

So I am trying to work out search that can cover a week/month period to calculate users' bandwidth over that period, the number of sessions they had as well, and have all of this on one table if possible.

[woodcock · Accepted solution]

This should definitely work:

... | stats sum(bandwidth_total) as "Bandwidth", sum(bandwidth_upload) as Upload, sum(bandwidth_download) as Download dc(sessionid) AS SessionIDs by user | sort -Bandwidth | rename Bandwidth as "Total Bandwidth"

If it is not working then the problem is probably with the extraction of the sessionid field/value or that the logs that have sessionid do not also have user (maybe user is spelled or capitalized differently).