topic Re: Can you help me sum the data in the following field? in Splunk Search

Can you help me sum the data in the following field?

maheshsat — Mon, 29 Oct 2018 14:02:00 GMT

Hi Team,

I have PATA field which needs to do sum of PATA field, am using below command where should add PATA to get sum of PATA field

index=pass  source="test" |eval DATE = YEAR."-".PERIOD| fields DATE | stats count by DATE

2018-10-24 14:43:50.556, S_DATE="201208", SCENARIO="Actual", YEAR="2016", PERIOD="Feb", VIEW="YTD", ENTITY="109", ENTITY_DESC="Test Canada Inc.", MARKET="Canada", ACCOUNT="922002", ACCOUNT_DESC="922002 - Employee Activity Food Bev", INTER_ENTITY="[ICP None]", VALUE="[Parent Total]", RC="21102", SUBACCOUNT="000000", INTER_RC="000000", PRODUCT="000000", CUSTOM5="USD_FUNC_Total", DATA_TYPE="Total_Late", PATA="179.03919201"

Re: Can you help me sum the data in the following field?

harsmarvania57 — Mon, 29 Oct 2018 14:19:15 GMT

Hi,

Can you please try below query ?

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats sum(PATA) AS Total_PATA by DATE

Re: Can you help me sum the data in the following field?

maheshsat — Mon, 29 Oct 2018 14:41:02 GMT

Thanks for quick reply

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE | stats count by DATE

getting below output

Date Count
2016-Apr 6000
2016-Aug 1000
2016-Dec 1229

My requirement

Date Count PATA
2016-Apr 6000

2016-Aug 1000
2016-Dec 1229

It should sum of PATA data with year and month wise , visible in PATA field

your command does not add count field , hence it is not working

Re: Can you help me sum the data in the following field?

harsmarvania57 — Mon, 29 Oct 2018 14:44:43 GMT

Have you tried to run query which I have provided ? You are still doing stats count instead of stats sum(PATA).... as I mentioned in previous comment.

Re: Can you help me sum the data in the following field?

maheshsat — Mon, 29 Oct 2018 15:01:49 GMT

yes i did your command , but count field is missing , and getting two fields Date and PATA

Re: Can you help me sum the data in the following field?

harsmarvania57 — Mon, 29 Oct 2018 15:05:24 GMT

If you want count and sum both, try below query

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats count, sum(PATA) AS Total_PATA by DATE

Re: Can you help me sum the data in the following field?

Vijeta — Mon, 29 Oct 2018 15:08:02 GMT

Try this-

index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE, PATA | stats count ,sum(PATA) AS Total_PATA by DATE

Re: Can you help me sum the data in the following field?

maheshsat — Mon, 29 Oct 2018 15:14:26 GMT

Thanks Its woking, Appreciate for your help

Re: Can you help me sum the data in the following field?

harsmarvania57 — Mon, 29 Oct 2018 15:21:51 GMT

Great that your problem is solved 🙂