topic Re: summing up rows by two column in Splunk Search

summing up rows by two column

ISP8055 — Fri, 02 Oct 2020 22:48:03 GMT

Hi there,

I have a table with 5 fields.
E column is numeric value, C is sub category of A

I want to sum E by column C AND column A.

A B C D E
a x 30

a y 20

a x 40

b y 10

b x 40

if I do stats(sum E) by A = it will give output of sum of first three rows of E.
if I do stats(sum E) by c = it will give output of rows by x and by e.
I want to output be like a x 50 ( 50 is 30 + 20 in this case)

Hope, I conveyed what I'm going for.

Re: summing up rows by two column

Richfez — Sat, 03 Oct 2020 00:57:44 GMT

I think what you want is ...

| stats sum(E) by A, C

And that should give you your answer. (I think you miscalculated your example. ax should be 30+40=70 and is the first and third lines, right?).

The output I get is

A C sum(E) a x 70 a y 20 b x 40 b y 10

And the run-anywhere search you can test with yourself was:

Happy Splunking!

-Rich

Re: summing up rows by two column

ISP8055 — Mon, 05 Oct 2020 22:05:43 GMT

You are correct. it should be 70. Sorry, typo on my end.