value | field1count | field2count |
---|---|---|
1 | 8 | 10 |
2 | 13 | 2 |
3 | 13 | 9 |
4 | 4 | 13 |
5 | 14 | 10 |
6 | 15 | 11 |
7 | 10 | 13 |
8 | 7 | 11 |
9 | 6 | 13 |
10 | 10 | 8 |
Last active
January 28, 2020 19:20
-
-
Save acharlieh/8cf7087ffd15b5ca8945 to your computer and use it in GitHub Desktop.
Getting counts of multiple fields
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| noop | |
| stats count | |
| fields | |
| eval raw=split("a=3 b=9 ; a=5 b=1 ; a=10 b=10 ; a=5 b=8 ; a=3 b=1 ; a=6 b=9 ; a=4 b=9 ; a=3 b=1 ; a=7 b=7 ; a=5 b=9 ; a=6 b=10 ; a=7 b=10 ; a=6 b=7 ; a=1 b=8 ; a=8 b=7 ; a=6 b=6 ; a=3 b=7 ; a=2 b=8 ; a=9 b=3 ; a=5 b=2 ; a=5 b=8 ; a=8 b=10 ; a=10 b=7 ; a=6 b=1 ; a=2 b=4 ; a=5 b=7 ; a=9 b=5 ; a=6 b=7 ; a=9 b=6 ; a=4 b=10 ; a=10 b=7 ; a=7 b=7 ; a=6 b=6 ; a=6 b=3 ; a=2 b=9 ; a=2 b=7 ; a=2 b=5 ; a=3 b=9 ; a=3 b=9 ; a=1 b=5 ; a=5 b=7 ; a=5 b=3 ; a=6 b=6 ; a=10 b=9 ; a=3 b=2 ; a=10 b=8 ; a=1 b=4 ; a=4 b=4 ; a=2 b=4 ; a=9 b=4 ; a=2 b=1 ; a=3 b=6 ; a=2 b=3 ; a=1 b=9 ; a=10 b=6 ; a=2 b=6 ; a=3 b=3 ; a=10 b=6 ; a=3 b=5 ; a=2 b=5 ; a=5 b=5 ; a=6 b=4 ; a=5 b=5 ; a=6 b=10 ; a=4 b=8 ; a=5 b=1 ; a=3 b=1 ; a=3 b=7 ; a=3 b=4 ; a=6 b=10 ; a=1 b=8 ; a=9 b=9 ; a=8 b=4 ; a=7 b=8 ; a=7 b=9 ; a=1 b=3 ; a=9 b=8 ; a=2 b=3 ; a=7 b=1 ; a=2 b=8 ; a=6 b=3 ; a=6 b=6 ; a=1 b=3 ; a=7 b=1 ; a=8 b=1 ; a=10 b=5 ; a=7 b=6 ; a=2 b=8 ; a=1 b=4 ; a=8 b=6 ; a=5 b=10 ; a=10 b=7 ; a=7 b=4 ; a=10 b=4 ; a=5 b=9 ; a=8 b=5 ; a=5 b=4 ; a=7 b=4 ; a=8 b=9 ; a=6 b=5",";") | |
| mvexpand raw | |
| rename raw as _raw | |
| extract auto=t | |
| rename a as field1 b as field2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| untable _raw field value | |
| stats count(eval(field=="field1")) as field1count count(eval(field=="field2")) as field2count by value | |
| sort value |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| appendpipe [stats count as field1count by field1 | rename field1 as value] | |
| appendpipe [stats count as field2count by field2 | rename field2 as value] | |
| stats first(*) as * by value | |
| sort value |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment