https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397742#M6784 <P>Hello,</P> <P>I'm trying to add values from rows. See the picture below. <IMG src="https://community.splunk.com/storage/temp/263611-example.png" alt="alt text" /></P> <P>What I am pretty much trying to do is add the count from unconfirmed_down status to the up status. The thing is is that the unconfirmed_down status isn't always there depending on the source I am pulling from and could vary from month to month, so I need to have an exception included in case it is not there. I have though have saying add field 1 to field 2, but that could produce incorrect results if that particular status is not there...</P> Tue, 29 Sep 2020 22:42:03 GMT dfrench151 2020-09-29T22:42:03Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397742#M6784 <P>Hello,</P> <P>I'm trying to add values from rows. See the picture below. <IMG src="https://community.splunk.com/storage/temp/263611-example.png" alt="alt text" /></P> <P>What I am pretty much trying to do is add the count from unconfirmed_down status to the up status. The thing is is that the unconfirmed_down status isn't always there depending on the source I am pulling from and could vary from month to month, so I need to have an exception included in case it is not there. I have though have saying add field 1 to field 2, but that could produce incorrect results if that particular status is not there...</P> Tue, 29 Sep 2020 22:42:03 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397742#M6784 dfrench151 2020-09-29T22:42:03Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397743#M6785 <P>@dfrench151 can you try the following?</P> <PRE><CODE>index=&lt;yourIndexName&gt; | eval status=if(status=="unconfirmed_down","up",status) | stats count by status </CODE></PRE> Sat, 12 Jan 2019 17:13:26 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397743#M6785 niketn 2019-01-12T17:13:26Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397744#M6786 <P>This only produced that status for up and count unfortunately</P> Sat, 12 Jan 2019 17:51:13 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397744#M6786 dfrench151 2019-01-12T17:51:13Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397745#M6787 <P>The above should move unconfirmed_down as up and remaining up and down status intact. So final sum should be only up and down status. Is your expectation different <BR /> ?</P> Sat, 12 Jan 2019 18:39:26 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397745#M6787 niketn 2019-01-12T18:39:26Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397746#M6788 <P>Sorry about that. I re-ran that and it did what I needed. Thank you</P> Sat, 12 Jan 2019 19:21:05 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397746#M6788 dfrench151 2019-01-12T19:21:05Z https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397747#M6789 <P>No problem. Glad it worked!</P> Sun, 13 Jan 2019 06:57:41 GMT https://community.splunk.com/t5/Splunk-Dev/Add-Values-from-Rows/m-p/397747#M6789 niketn 2019-01-13T06:57:41Z