topic Re: Stats sum function in Splunk Search

Stats sum function

Michael_Schyma1 — Mon, 16 Jul 2012 17:45:17 GMT

index=hig `sourcetype="MainframeApps"  |stats sum(count)|top limit=0  app_id app_name | fields + count, total_count,  percent,app_name, app_id | accum count AS total_count | rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"

I can not figure out why i can not get the sum function to work? any suggestions

Re: Stats sum function

lguinn2 — Mon, 28 Sep 2020 12:05:48 GMT

I think you just want

stats count

But I also think that you misunderstand how the Splunk command pipeline works. At each step of the pipeline, the intermediate results are transformed. After you run stats count in the pipeline, the fields app_name and app_id are no longer available to you, as they are no longer included in the intermediate results.

Try this search instead:

index=hig sourcetype="MainframeApps" 
| stats count by app_id app_name
| eventstats sum(count) as total_count
| eval percent = round(count*100/total_count,1)
| rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"

Re: Stats sum function

gkanapathy — Mon, 28 Sep 2020 12:06:04 GMT

or just
index=hig sourcetype=MainframeApps | top limit=0 app_id app_name

Re: Stats sum function

lguinn2 — Tue, 17 Jul 2012 07:27:18 GMT

Nice - I forgot about the limit=0 on the top command.