topic Re: How to add two field values count to another field value? in Splunk Search

How to add two field values count to another field value?

pranay_adla — Wed, 30 Sep 2020 00:49:55 GMT

I would like to add splunkd count and splunkd_access count as splunkd_total. Remaining table should look like this only. Can anyone help on this.

Re: How to add two field values count to another field value?

kamlesh_vaghela — Fri, 07 Jun 2019 11:36:17 GMT

@pranay_adla

Is that what you looking for?

index=_internal | stats count by sourcetype | replace splunkd* with splunkd_total in sourcetype | stats sum(count) as count by sourcetype

Re: How to add two field values count to another field value?

vnravikumar — Fri, 07 Jun 2019 12:05:37 GMT

Try this

index=_internal |eval sourcetype = if(sourcetype =="splunkd" OR sourcetype =="splunkd_access","splunkd_total",sourcetype)
| stats count by sourcetype

Re: How to add two field values count to another field value?

pranay_adla — Fri, 07 Jun 2019 13:15:38 GMT

Thanks Ravi,

Same way can we subtract splunkd_access count from splunkd count?

Re: How to add two field values count to another field value?

vnravikumar — Fri, 07 Jun 2019 13:27:54 GMT

Give a try

index=_internal 
| stats count by sourcetype 
| transpose 0 header_field=sourcetype 
| eval splunkd_total = splunkd + splunkd_access 
| eval splunkd_diff = splunkd - splunkd_access 
| fields - splunkd, splunkd_access 
| transpose 
| where column !="column"

Re: How to add two field values count to another field value?

pranay_adla — Fri, 07 Jun 2019 13:37:14 GMT

thank worked

Re: How to add two field values count to another field value?

pranay_adla — Fri, 07 Jun 2019 14:02:58 GMT

ravi small help if my field looks like this "HL7 - Its Duplicate Y". Eval not working can give me solution

Re: How to add two field values count to another field value?

vnravikumar — Fri, 07 Jun 2019 14:56:12 GMT

try with single quote 'HL7 - Its Duplicate Y'

Re: How to add two field values count to another field value?

pranay_adla — Mon, 10 Jun 2019 11:59:52 GMT

Not working '-' accepts only number's getting this message