Answer by warren for Counting by table with splunk – consolidate like fields

Try this:

| stats values(COMMAND) as COMMAND by HOST USER

from User warren – Stack Overflow https://stackoverflow.com/questions/63945800/counting-by-table-with-splunk-consolidate-like-fields/63958341#63958341
via IFTTT