If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same. Try something like this to get counts when fields equal a certain value: |stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX Or this to just count how many events are in a field called y and a field called x |stats count(x) as x_count count(y) as y_count by fieldX ... View more