topic Re: Adding Field Values Generated by a |stats latest(fieldvalue) command in Splunk Search

Adding Field Values Generated by a |stats latest(fieldvalue) command

jason_hotchkiss — Mon, 02 Nov 2020 17:09:59 GMT

Hello -

I have the following search:

<base search>
| fields host registrations
| stats latest(registrations) by host

This produces the following table:

host latest(registrations)
Pc1 51

Pc2 29

Pc3 18

How would I add the values of latest(registrations) to provide a single value for all 3 hosts? For example, I would like only the sum of the latest registrations (98) to display in a single value panel.

Thank you!

Re: Adding Field Values Generated by a |stats latest(fieldvalue) command

ITWhisperer — Mon, 02 Nov 2020 17:14:35 GMT

<base search> | fields host registrations | stats latest(registrations) as latest_reg by host | stats sum(latest_reg) as total_latest_reg

Re: Adding Field Values Generated by a |stats latest(fieldvalue) command

jason_hotchkiss — Mon, 02 Nov 2020 17:16:49 GMT

Thank you!! This worked for me.