topic Re: Combine similar fields in Splunk Search

How to Combine similar fields?

din98 — Wed, 06 Jul 2022 19:56:56 GMT

Hey all,

I have a summary table that shows these values and there are also some common values.

Process	Error	Success	Total
A	5	5	10
B	6	9	15
A	7	2	9
C	3	8	11
C	1	3	4
B	5	5	10

I want to combine these common values (under Process) and also add the numerical values together. I am hoping for a result like this in my summary table.

Process	Error	Success	Total
A	12	7	19
B	11	14	25
C	4	11	15

Any help would be much appreciated. Thanks!

Re: Combine similar fields

danielcj — Tue, 05 Jul 2022 13:52:17 GMT

Hello @din98 ,

Please try the following (assuming that your results are already on a table):

| stats sum(Error) as Error, sum(Success) as Success by Process | addtotals

Re: Combine similar fields

ITWhisperer — Tue, 05 Jul 2022 14:35:01 GMT

| stats sum(*) as * by Process

Re: Combine similar fields

din98 — Tue, 05 Jul 2022 14:46:31 GMT

Thanks guys! I generated the results successfully 🙂