topic Re: how to count values from a filed and show count as column in Splunk Search

how to count values from a filed and show count as column

siddhardhans — Wed, 17 Jun 2020 01:25:10 GMT

i am running below query to get total count by date_mday.

search query | eval ver=substr(av,1,4) | stats count(ver) by date_mday

and getting results for total count by month day.

date_mday	count
1	23
2	25
3	35
4	21

However, i want the results as ver count and total count - something like

date_mday	ver1234	ver2345	ver3456	ver4567	total Count
1	10	2	0	11	23
2	9	5	2	9	25
3	11	7	4	13	35
4	8	0	2	11	21

Since eval (eval ver=substr(av,1,4)) is dynamically populating the values to ver - I can't use | stats count(eval()) function. Please help me out.

Re: how to count values from a filed and show count as column

DalJeanis — Wed, 17 Jun 2020 05:09:40 GMT

Try this

search query | eval ver=substr(av,1,4) | chart count by date_mday ver | addtotals fieldname="Total Count" | addcoltotals labelfield=date_mday label="All Days"

Re: how to count values from a filed and show count as column

siddhardhans — Wed, 17 Jun 2020 01:42:19 GMT

@DalJeanis this is great - any suggestion to get total count on these dynamic columns?

Re: how to count values from a filed and show count as column

DalJeanis — Wed, 17 Jun 2020 05:10:14 GMT

| addtotals fieldname="Total Count" | addcoltotals labelfield=date_mday label="All Days"

The addtotals command will add up the totals horizontally, the addcoltotals will add them vertically.

I've updated the code above to include these.

Re: how to count values from a filed and show count as column

siddhardhans — Wed, 17 Jun 2020 15:45:09 GMT

@DalJeanis - thank you so much - i am able to see the table the way i needed.