Splunk Search

how to sum of count of values of fields?

thambisetty
SplunkTrust
SplunkTrust

Hi,
I have a search and output.
source="risks_repor.csv"| dedup "Computer Name" | search D-

Output:

values count %

Cleaned by deletion 10 19.608%

Left alone 6 11.765%

Deleted 5 9.804%

Cleaned 4 7.843%

Question:

sum as "Some string"="Cleaned by deletion" + "Left alone"
sum1 as "Some string1"="Deleted" + "Cleaned"

Expected output:

Some string Some string1

16 9

————————————
If this helps, give a like below.
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

this is not working i tried it....

————————————
If this helps, give a like below.
0 Karma

somesoni2
Revered Legend

Can you provide more information on how it didn't work? Also, please check the name of fields and apply those in the answer provided here.

0 Karma

harshal_chakran
Builder

Hi,

source="risks_repor.csv".....|table value count |where value="Cleaned" OR value ="Deleted"|stats sum(count) as Somestring1|
appendcols[search source="risks_repor.csv".....|table value count|where value="Left alone" OR value ="Cleaned by deletion"|stats sum(count) as Somestring]

I hope this helps..!!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...