https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279502#M176329 <P>stats sum(count) is not needed. just stats count is fine. <BR /> <PRE> |stats count by Asset_status</PRE></P> <PRE>eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status </PRE> Tue, 25 Oct 2016 12:21:07 GMT inventsekar 2016-10-25T12:21:07Z https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279501#M176328 <P>For me the below <STRONG>stats sum(count) by Asset_status</STRONG> provies no results .</P> <P>eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="<EM>eskto</EM>" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats sum(count) by Asset_status</P> <P>Asset_status sum(count)<BR /> Desktop<BR /><BR /> Others<BR /><BR /> Server </P> <P>May i please know the reason for this and how can i get the sum of counts values.</P> Tue, 29 Sep 2020 11:35:41 GMT https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279501#M176328 umsundar2015 2020-09-29T11:35:41Z https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279502#M176329 <P>stats sum(count) is not needed. just stats count is fine. <BR /> <PRE> |stats count by Asset_status</PRE></P> <PRE>eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status </PRE> Tue, 25 Oct 2016 12:21:07 GMT https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279502#M176329 inventsekar 2016-10-25T12:21:07Z https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279503#M176330 <P>also, you can use case instead of a nested if</P> <PRE><CODE>...|eval Asset_status= case(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server", Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop",1=1,"Others")|stats count by Asset_status </CODE></PRE> Tue, 25 Oct 2016 19:46:44 GMT https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279503#M176330 cmerriman 2016-10-25T19:46:44Z https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279504#M176331 <P>Hi Umsundar, may i know if this issue got resolved, can you please mark it as accepted answer..</P> Wed, 26 Oct 2016 11:30:09 GMT https://community.splunk.com/t5/Splunk-Search/the-function-sum-count-by-xx-field-is-not-working/m-p/279504#M176331 inventsekar 2016-10-26T11:30:09Z