get count of field group by another

[jdepp]

This should be so simple but I cannot get it to work. I am trying to create a panel that will display a table with three columns:

 THREAD               TYPE                    COUNT

the search should find the count of each thread and group it by type. for example:

THREAD               TYPE                    COUNT
   A                          searcher              10
   B                          grouper                20
   A                          compiler               2
   C                          searcher                5

Meaning each thread can have different types:

sourcetype="thread.stats" | chart count by thread_id | sort -count by thread_id,type

any help appreciated

[cmerriman]

 sourcetype="thread.stats" | stats count by thread_id type| sort - count 

try that

[jdepp]

thanks. Both of you answered almost at the same time. Really appreciate it. But have to go with cusello as he was first by seconds.

[gcusello · Accepted solution]

hI jdepp,
try

sourcetype="thread.stats" | stats count by thread_id, type | sort -count

It's not clear the sort order.
Bye.
Giuseppe

[jdepp]

thanks. Both of you answered almost at the same time. Really appreciate it.