Hi,
As the title suggests, I am after a query which gives me both the values of count(x) and count(y) by fieldX to be used later on in queries.
Is this possible?
Virtual beer and kudos for the best answer.
Kr,
If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same.
Try something like this to get counts when fields equal a certain value:
|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX
Or this to just count how many events are in a field called y and a field called x
|stats count(x) as x_count count(y) as y_count by fieldX
If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same.
Try something like this to get counts when fields equal a certain value:
|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX
Or this to just count how many events are in a field called y and a field called x
|stats count(x) as x_count count(y) as y_count by fieldX