Simple eventstats field is always blank

[mv10]

I have a relatively simple query that counts HTTP 404 events in IIS logs. I wanted to sort them according to which hosts had the highest individual count, however the "highcount" field is always blank. (I probably need to also sort by host, but that's irrelevant to the eventstats issue.)

index=iis status=404 uri="*/*.*"
|stats count by host uri
|eventstats max(count) by host as highcount
|sort -highcount -count
|table highcount count host uri

[richgalloway · Accepted solution]

The eventstats syntax is incorrect.  Try this

index=iis status=404 uri="*/*.*"
|stats count by host uri
|eventstats max(count) as highcount by host
|sort -highcount -count
|table highcount count host uri

[mv10]

Groan. 😁