topic Re: Sum of Total count in another column in Splunk Enterprise

Sum of Total count in another column

goringop — Wed, 05 Aug 2020 14:35:32 GMT

Need help on my query, I want to achieve this kind of table shown below

What I want is to get the total_count value for each app by adding the values under count and get sum of it under total_count

app	dest_port	count	total_count
ssl	10001 10020 13000 13006 22790 26107 443 44345 4	21 2 3 2 8 19 22 55 323	?
web-browsing	1000 21 443 5000 7788 80 8003 8080	2 3 4 7 1000 200 12 21	?

Re: Sum of Total count in another column

richgalloway — Wed, 05 Aug 2020 14:08:57 GMT

An eval should do it.

| stats values(dest_port) as dest_port count(bytes) as count by app | eval total_count = mvcount(count)

Re: Sum of Total count in another column

goringop — Wed, 05 Aug 2020 14:10:51 GMT

it works 🙂 thank you for your help

Re: Sum of Total count in another column

goringop — Wed, 05 Aug 2020 14:23:04 GMT

@richgalloway

it seems that the count for each dest_port where gone, then Im getting the total_count with a value of 1

Re: Sum of Total count in another column

richgalloway — Wed, 05 Aug 2020 14:33:17 GMT

Try getting the total count from dest_port.

| stats values(dest_port) as dest_port count(bytes) as count by app | eval total_count = mvcount(dest_port)

Re: Sum of Total count in another column

goringop — Wed, 05 Aug 2020 14:41:50 GMT

@richgalloway thanks for the reply but still not getting the correct value. please see below screenshot. Under the count column, I want to see all the value for each port then Under the total_count column I want to see the sum of counts for that specific app

Re: Sum of Total count in another column

goringop — Wed, 05 Aug 2020 14:49:55 GMT

@richgalloway

a table something like this:

app	dest_port	count	total_count
ssl	10001 10020 13000 13006 22790 26107 443 44345 4	21 2 3 2 8 19 22 55 323	455
web-browsing	1000 21 443 5000 7788 80 8003 8080	2 3 4 7 1000 200 12 21	1249

Re: Sum of Total count in another column

richgalloway — Thu, 20 Aug 2020 21:03:50 GMT

Sorry. I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help. Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this:

... | mvstats sum count as total_count

Re: Sum of Total count in another column

goringop — Tue, 25 Aug 2020 11:51:05 GMT

@richgalloway thank you for this, I will install the app and get back to you