Splunk Search

How do I add the count of string values in each row?

477450
Explorer

Hi guys,

If I want to add the total values from each row, I can use the command | addtotal and this is only used to add numeric values, but if I want to add the number of string values from each row, which command can I use....? I want my output to be like this.

host   field1   field2   field2   Total
h1    abc     efg      ghi     3
h2   jkl      mno               2
h3             pqr              1

Thanks in advance

0 Karma
1 Solution

477450
Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count

View solution in original post

0 Karma

477450
Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count
0 Karma

somesoni2
Revered Legend

Try something like this

YOur current search giving example output (without Total) | untable host metric value | appendpipe [| stats dc(value) as value by host | eval metric="Total" ] | chart values(*) over host by metric | table host * Total
0 Karma

477450
Explorer

Thanks buddy ..but this is adding each character of the string, i want the total of all the fields values in a single row.

0 Karma

somesoni2
Revered Legend

My bad, was using the wrong column in the appendpipe. Just updated. See if that works.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...