Splunk Search

how to sum of count of values of fields?

thambisetty
SplunkTrust
SplunkTrust

Hi,
I have a search and output.
source="risks_repor.csv"| dedup "Computer Name" | search D-

Output:

values count %

Cleaned by deletion 10 19.608%

Left alone 6 11.765%

Deleted 5 9.804%

Cleaned 4 7.843%

Question:

sum as "Some string"="Cleaned by deletion" + "Left alone"
sum1 as "Some string1"="Deleted" + "Cleaned"

Expected output:

Some string Some string1

16 9

————————————
If this helps, give a like below.
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

this is not working i tried it....

————————————
If this helps, give a like below.
0 Karma

somesoni2
Revered Legend

Can you provide more information on how it didn't work? Also, please check the name of fields and apply those in the answer provided here.

0 Karma

harshal_chakran
Builder

Hi,

source="risks_repor.csv".....|table value count |where value="Cleaned" OR value ="Deleted"|stats sum(count) as Somestring1|
appendcols[search source="risks_repor.csv".....|table value count|where value="Left alone" OR value ="Cleaned by deletion"|stats sum(count) as Somestring]

I hope this helps..!!!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...