i am running below query to get total count by date_mday. search query | eval ver=substr(av,1,4) | stats count(ver) by date_mday and getting results for total count by month day.  date_mday count 1 23 2 25 3 35 4 21   However, i want the results as ver count and total count - something like date_mday ver1234 ver2345 ver3456 ver4567 total Count 1 10 2 0 11 23 2 9 5 2 9 25 3 11 7 4 13 35 4 8 0 2 11 21   Since eval (eval ver=substr(av,1,4)) is dynamically populating the values to ver - I can't use | stats count(eval()) function. Please help me out. ... View more