How to edit my search to add a column with total count per source?

[sicspunky]

Hi All,

Cracking my head trying to get this to work.
Basically i need to add another column which will be "Count". Total count of all the hits per source to the URLs. Eg: Source A hits Google 10 times and Yahoo 12 times. So the url portion will show google & yahoo + a total count of 22.

Current search as below.

table src desc ResolvedDomain  |dedup ResolvedDomain src| mvcombine ResolvedDomain|rename src as Source |rename dst as "Dst IP"| rename desc as "Description" | rename ResolvedDomain as URL 

Can anyone point me in the right direction? what should i use?

Thanks
De

[somesoni2]

Give this a try

base search| table src desc ResolvedDomain 
|stats count by src dst desc ResolvedDomain
| stats list(count) as count sum(count) as TotalCount list(ResolvedDomain) as URL by src dest desc
|rename src as Source dst as "Dst IP"  desc as "Description"