https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237180#M188606 <P>Try like this</P> <PRE><CODE>your base search | eval successcalls=if(result = "declined" OR result = "caller_ended" OR result = "callee_ended",count,null()) | stats sum(count) as NumberofCalls, sum(successcalls) as SuccessfulCalls </CODE></PRE> Mon, 07 Mar 2016 19:09:25 GMT somesoni2 2016-03-07T19:09:25Z https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237179#M188605 <P>I have incoming calls and I'm trying to get total number of calls followed by sum of calls where the field "result" equals declined, caller_ended, or callee_ended. I'm able to get the sum(count) but for the second part I am only getting a count of the events when really I want to sum the count.</P> <P>How can I get a sum of the field count where result is equal to "callee_ended", "caller_ended" or "declined" without filtering the first part of the query</P> <P>|stats sum(count) as NumberofCalls , sum(eval(if((result = "declined" OR result = "caller_ended" OR result = "callee_ended"), count, NULL))) AS SuccessfulCalls</P> Tue, 29 Sep 2020 09:00:43 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237179#M188605 dcavag001c 2020-09-29T09:00:43Z https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237180#M188606 <P>Try like this</P> <PRE><CODE>your base search | eval successcalls=if(result = "declined" OR result = "caller_ended" OR result = "callee_ended",count,null()) | stats sum(count) as NumberofCalls, sum(successcalls) as SuccessfulCalls </CODE></PRE> Mon, 07 Mar 2016 19:09:25 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237180#M188606 somesoni2 2016-03-07T19:09:25Z https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237181#M188607 <P>Thanks for your response but that still only returns the count of events with those parameters rather than a sum(count) with those parameters.</P> Mon, 07 Mar 2016 19:36:14 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237181#M188607 dcavag001c 2016-03-07T19:36:14Z https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237182#M188608 <P>That should've worked, I've setting the value of successcall to count when your result value follows those condition. Could you post the query that you tried, possibly full query?</P> Mon, 07 Mar 2016 19:38:59 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237182#M188608 somesoni2 2016-03-07T19:38:59Z https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237183#M188609 <P>Sorry about that. The query I was using to check the count was incorrect. Your query works! Sorry for the confusion.</P> Mon, 07 Mar 2016 20:10:25 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-count-conditionally-within-a-query/m-p/237183#M188609 dcavag001c 2016-03-07T20:10:25Z