Hi Team,
I am using the below command for getting the total value of Payable_Column & show the total count:
index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | addcoltotals
Example
Payable_Column Count
1 1
2 2
3 2
Required
Payable_Column Count
6 5
index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats sum(Payable_Column) as Payable_Column , sum(count) as count
is that what you want?
Sid
@sdchakraborty Perfect but it is taking too much time to fetch data , i have 4000000 events. Can we expedite by using tstats command
You can use tstats
if the fields in the command are index fields.
but what be the command
| tstats index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats sum(Payable_Column) as Payable_Column , sum(count) as count