Query on stats values

[p_basanth]

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count of each Domain.

| stats count by values(Domain) does not provide any results.

I am expecting the below output

Host1 --> Domain1 --> 5

        --> Domain2 --> 8

        --> Domain3 --> 1

Host2 --> Domain1 --> 9

        --> Domain2 --> 3

        --> Domain3 --> 7

[Ayn · Accepted solution]

The by-clause expects field names, nothing else. You should take the Splunk tutorial if you haven't already, it covers things like this.

... | stats count by Short_Host,Domain

[Ayn]

? That's exactly what you get. If you want it split up not by Short_Host AND Domain, just split by Domain.

[p_basanth]

is it not possible to get count for each values(Domain)