help on stats count by command

[jip31]

hello

I use the search below in order to do a total count by OS and by build
It mean that it counts only events which have a build AND an OS
I would like to do another count but this time I would like to do a total count of events which have a build OR an OS
Could you help me please??

eventtype="AppliEV" | fields Name, Level, host 
| dedup host 
| stats count by host 
| join host type="outer" 
    [ search index="x" sourcetype=x key_path="x" 
        OR 
        key_path="x" 
    | eval OS=if(key_path=="x"), 
        Build=if(key_path=="x" 
    | stats latest(OS) as OS latest(Build) as Build by host] 
| stats values(OS) as OS values(Build) as Build by host 
| stats count as Total by OS Build

[FrankVl · Accepted solution]

One way to approach that would be:

 eventtype="AppliEV" | fields Name, Level, host 
 | dedup host 
 | stats count by host 
 | join host type="outer" 
     [ search index="x" sourcetype=x key_path="x" 
         OR 
         key_path="x" 
     | eval OS=if(key_path=="x"), 
         Build=if(key_path=="x" 
     | stats latest(OS) as OS latest(Build) as Build by host] 
 | stats values(OS) as OS values(Build) as Build by host 
 | fillnull value="unknown" OS,Build
 | stats count as Total by OS Build

By using fillnull, every event will have an OS and a Build value (value is set to "unknown" when it did not have a value).

[jip31]

Many thanks franck