Counting by table with splunk - consolidate like fields

Question

I have the following | stats count by HOST, USER, COMMAND | table HOST USER COMMAND count and it gives me a list of what I expect, but I can't seem to figure out how to consolidate HOST and USER and just count how many commands there were so it's just one row.

I'm pretty sure I'm supposed to use list in some way but my results still don't seem to consolidate correctly. Any clues?

I'm trying like this:

 stats list(HOST) as HOST list(USER) as USER count(COMMAND) list(count) as count by COMMAND

Answer 1

Try this:

| stats values(COMMAND) as COMMAND by HOST USER