i have a field called "Status" which contains "fresh" or "stale" which is distinct via host
I want to do a distinct count by status in one row
the "fresh" count is 20
the "stale" count is 1
i tried doing stats count(eval(status="fresh")) AS fresh1 count(eval(status="stale")) AS stale1 by host
it continues to give me "1" for the "fresh" count when it should be 20.
The only way this works is if i do stats count(eval(freshness="Fresh")) AS fresh1 by status.
The problem is that it splits it in two rows. I need the answers in one row.
Please Help
Couldn't you just do
... | chart count by host,status
?