topic Add count of field instead of just count it in Splunk Search

Add count of field instead of just count it

indeed_2000 — Thu, 08 Jul 2021 11:55:15 GMT

Hi I have log file that each minute store 1 event like this

8:00 1

8:01 1

8:02 1

instead of counting i want store last value and add new value to that, like this:

8:48 2

8:49 12 (10+2)

8:50 20 (3+12)

8:51 21 (1+20)

…

any idea?

Thanks

Re: Add count of field instead of just count it

venkatasri — Thu, 08 Jul 2021 12:13:35 GMT

Hi @indeed_2000 You have to use streamstats command.

Re: Add count of field instead of just count it

venkatasri — Thu, 08 Jul 2021 12:23:12 GMT

@indeed_2000

You can try something like this, i assumed your field name for numerical as 'count' you have to change it for your case.

<your_search_goes_here> | reverse | streamstats sum(count)

Output would be something like this,

---

An upvote would be appreciated and Accept solution if this reply helps!

Re: Add count of field instead of just count it

ITWhisperer — Thu, 08 Jul 2021 12:22:27 GMT

| streamstats sum(count) as runningtotal

Re: Add count of field instead of just count it

indeed_2000 — Thu, 08 Jul 2021 13:45:56 GMT

Field value is not number

field name= status (success,fail)

Also i try these but not work:

index=main | reverse | streamstats sum(status)

index=main | reverse | streamstats sum(count(status))

any idea?

Thanks

Re: Add count of field instead of just count it

ITWhisperer — Thu, 08 Jul 2021 14:04:37 GMT

Can you provide some sample events?

Re: Add count of field instead of just count it

indeed_2000 — Thu, 08 Jul 2021 14:15:38 GMT

I do field extraction that the name is “status”, and value is “fail” or “success”.

2021-07-06 23:11:12,197 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,187 INFO [app] success, User: anonymous
2021-07-06 23:11:12,178 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,167 INFO [app] success, User: anonymous
2021-07-06 23:11:12,159 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,149 INFO [app] success, User: anonymous
2021-07-06 23:11:12,141 INFO [app] fail , time[10] User: anonymous
2021-07-06 23:11:12,131 INFO [app] success, User: anonymous
2021-07-06 23:11:12,134 INFO [app] success, User: anonymous
2021-07-06 23:11:12,138 INFO [app] success, User: anonymous

expected result:
fail 1
success 1
fail 2
success 2
fail 3
success 3
fail 4
success 4
success 5
success 6

Re: Add count of field instead of just count it

ITWhisperer — Thu, 08 Jul 2021 14:20:48 GMT

Try this:

| streamstats count by status