Splunk Search

how to sum of count of values of fields?

thambisetty
SplunkTrust
SplunkTrust

Hi,
I have a search and output.
source="risks_repor.csv"| dedup "Computer Name" | search D-

Output:

values count %

Cleaned by deletion 10 19.608%

Left alone 6 11.765%

Deleted 5 9.804%

Cleaned 4 7.843%

Question:

sum as "Some string"="Cleaned by deletion" + "Left alone"
sum1 as "Some string1"="Deleted" + "Cleaned"

Expected output:

Some string Some string1

16 9

————————————
If this helps, give a like below.
Tags (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

this is not working i tried it....

————————————
If this helps, give a like below.
0 Karma

somesoni2
Revered Legend

Can you provide more information on how it didn't work? Also, please check the name of fields and apply those in the answer provided here.

0 Karma

harshal_chakran
Builder

Hi,

source="risks_repor.csv".....|table value count |where value="Cleaned" OR value ="Deleted"|stats sum(count) as Somestring1|
appendcols[search source="risks_repor.csv".....|table value count|where value="Left alone" OR value ="Cleaned by deletion"|stats sum(count) as Somestring]

I hope this helps..!!!

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...