Hello Sathish,
After you group by stats you will get the _raw data into a multi valued field. In that case you can use some mvfilter function to get the value and mv fuctions to get the count as well. Apart from that if you want to divide the fields use mvexpand then search for the value.
_http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchReference/CommonEvalFunctions
Thanks
if the DelSize can't be included in the stats in your search you can use append then make another stats to show the DelSize. After your search
|append[|search ...|| eval DelSize=if(Folder="Deleted Items",Size,"")|stats Value(DelSize) as DelSize by user]|stats Values(FolderCount) as FolderCount, Values(DelSize) as DelSize by User
But first try this
..... | eval DelSize=if(Folder="Deleted Items",Size,"") |stats count as FolderCount,Values(DelSize) as DelSize, sum(Size) as TotalSize,sum(Items) as TotalItems by User | table User FolderCount DelSize
Thank you Linu, am doing eval and assigning value to variable/Field befor stats command, But am not able to get the value of assigned to field/variable..
Ex: ..... | eval DelSize=if(Folder="Deleted Items",Size,"") |stats count as FolderCount, sum(Size) as TotalSize,sum(Items) as TotalItems by User | table User FolderCount DelSize.
here not able to get Delsize value.