topic Re: sum(count) returning 0 events in Splunk Search

sum(count) returning 0 events

pedropiin — Mon, 10 Mar 2025 14:56:37 GMT

Hi everyone.

I have a query that basically filters certain events and sums them by category. But I'm facing issues when dealing with stats sum.

The query is of the form

index=main source=... ... ... | stats count BY name, ticket | stats sum(count) as numOfTickets by name

Using some test data, removing the last line gives me a table with only one row of the form:
" name | tickets | count "
" name1 | ticket_name1 | 1"
(considering the first line as the names of the fields).
Whenever I run the last line, that is, "stats sum(count)..." , it returns 0 events.

I've already tried to, for example, redundantly check that count is a numeric value by doing "eval count = tonumber(count)".

Why is this happening?

Thank you in advance

Re: sum(count) returning 0 events

gcusello — Mon, 10 Mar 2025 15:00:50 GMT

Hi @pedropiin ,

this search hasn't sense, you could run:

index=main source=... ... ... | stats count BY name

Ciao.

Giuseppe

Re: sum(count) returning 0 events

pedropiin — Mon, 10 Mar 2025 15:12:14 GMT

Hi Giuseppe. Thank you for your response.

This is just with test data. When I deal with a real scenario, face the same issue but it I can't simply run "count".

Re: sum(count) returning 0 events

gcusello — Mon, 10 Mar 2025 16:01:15 GMT

Hi @pedropiin ,

there isn't any reason for your behavior: after a stats command you have only the fields present in the command.

Could you share the full search?

Ciao.

Giuseppe

Re: sum(count) returning 0 events

ITWhisperer — Mon, 10 Mar 2025 17:13:32 GMT

Your sample test data shows a field called "tickets" when your stats command is using a field called "ticket" - is it simply a typo in your example, or in your actual search?