<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Splunk JavaScript API getting stats in a search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Splunk-JavaScript-API-getting-stats-in-a-search/m-p/226497#M66791</link>
    <description>&lt;P&gt;I am using the Splunk JavaScript API to create a dashboard to aggregate data. One of my searches that I want literally just sums up the total of a given field using&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=[index] source="[path]" | stats sum("Val_in rep_cur") as Total
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Even though this gives the correct number on the website, it is in the 'statistics' tab. When I run this same search in the JavaScript API, the results object is just empty. How can I get the sum of a field in the JavaScript API?&lt;/P&gt;

&lt;P&gt;EDIT:&lt;BR /&gt;
So it looks like if I replace stats with eventstats it will add a new field to each event. However, I am still not getting any results in the API.&lt;/P&gt;

&lt;P&gt;My new search is&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=[index] source="[path]" | eventstats sum("Val_in rep_cur") as Total | dedup Total | fields Total
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Thu, 11 Aug 2016 13:01:56 GMT</pubDate>
    <dc:creator>najarvis</dc:creator>
    <dc:date>2016-08-11T13:01:56Z</dc:date>
    <item>
      <title>Splunk JavaScript API getting stats in a search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-JavaScript-API-getting-stats-in-a-search/m-p/226497#M66791</link>
      <description>&lt;P&gt;I am using the Splunk JavaScript API to create a dashboard to aggregate data. One of my searches that I want literally just sums up the total of a given field using&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=[index] source="[path]" | stats sum("Val_in rep_cur") as Total
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Even though this gives the correct number on the website, it is in the 'statistics' tab. When I run this same search in the JavaScript API, the results object is just empty. How can I get the sum of a field in the JavaScript API?&lt;/P&gt;

&lt;P&gt;EDIT:&lt;BR /&gt;
So it looks like if I replace stats with eventstats it will add a new field to each event. However, I am still not getting any results in the API.&lt;/P&gt;

&lt;P&gt;My new search is&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;search index=[index] source="[path]" | eventstats sum("Val_in rep_cur") as Total | dedup Total | fields Total
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 11 Aug 2016 13:01:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-JavaScript-API-getting-stats-in-a-search/m-p/226497#M66791</guid>
      <dc:creator>najarvis</dc:creator>
      <dc:date>2016-08-11T13:01:56Z</dc:date>
    </item>
    <item>
      <title>Re: Splunk JavaScript API getting stats in a search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Splunk-JavaScript-API-getting-stats-in-a-search/m-p/226498#M66792</link>
      <description>&lt;P&gt;&lt;STRIKE&gt;Somehow removing the source ended up fixing the problem&lt;/STRIKE&gt;. The answer I was looking for was changing stats to eventstats. I only had two backslashes in my search, but because it was in a string in JavaScript it needed 4.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="G:\\AutoIndex\\spending\\Catalog Report - 8758 Devices.csv"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;should've been&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;source="G:\\\\AutoIndex\\\\spending\\\\Catalog Report - 8758 Devices.csv"
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 11 Aug 2016 14:48:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Splunk-JavaScript-API-getting-stats-in-a-search/m-p/226498#M66792</guid>
      <dc:creator>najarvis</dc:creator>
      <dc:date>2016-08-11T14:48:26Z</dc:date>
    </item>
  </channel>
</rss>

