https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450928#M127690 <P>@whunterj try the following eval after your fields pipe <CODE>| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)</CODE></P> <PRE><CODE>index=citrix majorCustomer=* Host=* | fields majorCustomer Host | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer) | rename majorCustomer as "Line of Business" | stats count(Host) as Servers by "Line of Business" | eventstats sum(Servers) as Total | eval Percentage = (Servers/Total)*100 | eval Percentage = round(Percentage, 2) | eval Percentage = Percentage + "%" | table "Line of Business" Servers Percentage | sort -Servers </CODE></PRE> <P>PS: <CODE>IN</CODE> clause will work only if you are on <CODE>Splunk 6.6</CODE> or higher, or else you would need to use <CODE>majorCustomer=="commercial" OR majorCustomer=="information systems"</CODE></P> Thu, 27 Jun 2019 14:07:17 GMT niketn 2019-06-27T14:07:17Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450927#M127689 <P>I have written a search that breaks down the four values in the majorCustomer field and counts the number of servers in each of the four majorCustomers. What I want to do is combine the commercial and information systems customer into one called corporate and have the count be a sum of their individual server counts. Any suggestions?</P> <P>This is the search:</P> <PRE><CODE>index=citrix | fields majorCustomer Host | rename majorCustomer as "Line of Business" | stats count(Host) as Servers by "Line of Business" | eventstats sum(Servers) as Total | eval Percentage = (Servers/Total)*100 | eval Percentage = round(Percentage, 2) | eval Percentage = Percentage + "%" | table "Line of Business" Servers Percentage | sort -Servers! </CODE></PRE> <P><A href="https://answers.splunk.comstorage/temp/273086-query-question.png">alt text</A></P> Thu, 27 Jun 2019 13:35:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450927#M127689 whunterj 2019-06-27T13:35:51Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450928#M127690 <P>@whunterj try the following eval after your fields pipe <CODE>| eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer)</CODE></P> <PRE><CODE>index=citrix majorCustomer=* Host=* | fields majorCustomer Host | eval majorCustomer=case(majorCustomer IN ("commercial","information systems"),"Corporate",true(),majorCustomer) | rename majorCustomer as "Line of Business" | stats count(Host) as Servers by "Line of Business" | eventstats sum(Servers) as Total | eval Percentage = (Servers/Total)*100 | eval Percentage = round(Percentage, 2) | eval Percentage = Percentage + "%" | table "Line of Business" Servers Percentage | sort -Servers </CODE></PRE> <P>PS: <CODE>IN</CODE> clause will work only if you are on <CODE>Splunk 6.6</CODE> or higher, or else you would need to use <CODE>majorCustomer=="commercial" OR majorCustomer=="information systems"</CODE></P> Thu, 27 Jun 2019 14:07:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450928#M127690 niketn 2019-06-27T14:07:17Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450929#M127691 <P>This is exactly what I was trying to do. Thank you!</P> Thu, 27 Jun 2019 15:19:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450929#M127691 whunterj 2019-06-27T15:19:02Z https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450930#M127692 <P>If that's it, then click <CODE>Accept</CODE> to close the question.</P> Thu, 27 Jun 2019 16:03:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-Values-Within-Stats-Command/m-p/450930#M127692 woodcock 2019-06-27T16:03:09Z