- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to display stats results by values(field)
I am using the following query and trying to display the results using stats but count by field values
search query |
| table A B C D E
| stats count values(A) as errors values(B) values(C) by E
Also tried
| stats count by E A B C [but this messes up everything as this requires every field to have values]
Current Output
E count A. B C
Value1. 10. X YY ZZZ
Y ZZ BBB
Output
E count A. B C
Value1. 8. X YY ZZZ
2 Y ZZ BBB
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

search query |
| table A B C D E
| fillnull value="N/A" A B C
| stats count by E A B C
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this doesn't solve my problem
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Please explain what is not working for you with this method
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
results which I am getting arent accurate and its not making any sense
I want the count for each value you see in the first value and with the above solution this is not accurate and doesnt work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Can you share the search you used to get these results?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
for now
"your base search" | fillnull value=NA errors
| stats count values(traceid_id) as TraceId by title errors
but I also tried with [this gives me completely different results and I want results by title]
"your base search" | fillnull value=NA errors traceid_id
| stats count by title errors traceid_id
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It is usually easier when you describe your issue with closer to reality examples. Try something like this
"your base search" | fillnull value=NA errors traceid_id
| stats count by title errors traceid_id
| stats list(count) as count list(errors) as errors list(traceid_id) as traceid_id by title
