Splunk Search

How to add the values of a column and show the result as a separate field?

vrmandadi
Builder

Hello Expebrts,

I am trying to add the values of a column and show the result in another field, but I am not able to generate it.

Example:

index=abc |stats count by name 

Current Output:
a_req 4
a_resp 2
b_req 5
b_resp 5

Desired Output:
a 6

b 10

It should add a_req and a_resp and show a result in new column with the aggregate values

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The current search is counting name. If you want to count by a different field, you have to specify that field (and create it, if necessary). Try this:

index=abc | rex field=name "(?<aggrName>\w+)_" | stats count by aggrName
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The current search is counting name. If you want to count by a different field, you have to specify that field (and create it, if necessary). Try this:

index=abc | rex field=name "(?<aggrName>\w+)_" | stats count by aggrName
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thanks richgalloway

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...