https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209143#M61097 <P>Before this stats command, there are fields called count and foo (there could be other fields). The command <CODE>stats sum(count) by foo</CODE> generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field) </P> Wed, 21 Sep 2016 18:55:01 GMT somesoni2 2016-09-21T18:55:01Z https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209142#M61096 <P>Hey, a really basic question, but I'm unsure of the answer. What does <CODE>stats sum(count) by</CODE> do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does <CODE>stats sum(count)</CODE> do? I've looked for a while and can't figure out what it does. </P> Wed, 21 Sep 2016 18:50:09 GMT https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209142#M61096 Justin1224 2016-09-21T18:50:09Z https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209143#M61097 <P>Before this stats command, there are fields called count and foo (there could be other fields). The command <CODE>stats sum(count) by foo</CODE> generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field) </P> Wed, 21 Sep 2016 18:55:01 GMT https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209143#M61097 somesoni2 2016-09-21T18:55:01Z https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209144#M61098 <P>So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)?<BR /> Thank you for your help!</P> Wed, 21 Sep 2016 18:59:55 GMT https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209144#M61098 Justin1224 2016-09-21T18:59:55Z https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209145#M61099 <P>That is correct.</P> Wed, 21 Sep 2016 19:01:40 GMT https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209145#M61099 somesoni2 2016-09-21T19:01:40Z https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209146#M61100 <P>Great thank you, you really helped me out!</P> Wed, 21 Sep 2016 19:07:24 GMT https://community.splunk.com/t5/Splunk-Search/What-does-quot-stats-sum-count-by-quot-do/m-p/209146#M61100 Justin1224 2016-09-21T19:07:24Z