topic column totals in Splunk Search

column totals

a212830 — Wed, 25 Jun 2014 11:32:44 GMT

Hi,

I want to add some totals for a search. The search is below, and it works fine. How would I then add:

totals for all hosts
subtotal by index and sourcetype

index=ngcc* |fields host, index, sourcetype |dedup host, index, sourcetype |table host, index, sourcetype |sort host

Re: column totals

martin_mueller — Wed, 25 Jun 2014 11:46:11 GMT

Are you looking to count values by some fields? Take a look at the stats command: http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/stats

I'm not quite sure what your desired result looks like, maybe post an example.

Re: column totals

lpolo — Wed, 25 Jun 2014 12:20:30 GMT

I am not sure what you need to but try this query. It might help you to get what you need:

  index=ngcc*|fields host, index, sourcetype  |dedup host, index, sourcetype  |table host, index, sourcetype |sort host|streamstats count

Re: column totals

somesoni2 — Wed, 25 Jun 2014 12:59:26 GMT

Give this a try

index=ngcc* |fields host, index, sourcetype |dedup host, index, sourcetype |table host, index, sourcetype |sort host | eventstats count as GrandTotal | eventstats count as SubTotal by index, sourcetype

OR simply

index=ngcc*  |stats count by host, index, sourcetype  | fields - count | stats count as SubTotal by index, sourcetype | eventstats sum(SubTotal) as AllHostTotal