- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: What does "stats sum(count) by" do?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey, a really basic question, but I'm unsure of the answer. What does stats sum(count) by do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does stats sum(count) do? I've looked for a while and can't figure out what it does.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)?
Thank you for your help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great thank you, you really helped me out!
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
