topic Re: How to add a separate column which displays the total of the count? in Splunk Search

How to add a separate column which displays the total of the count?

pavanae — Fri, 09 Oct 2015 17:17:37 GMT

The following is my search

…..My Search…… | stats count by orderid,source,host

Which displays the following results

orderid source host count
971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1
106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1
147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1
569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2
670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1
862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1
038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1

Now how can i modify my search to display a separate column and shows the total count as follows

orderid source host count Total_Count
971729145 /jboss/server/12commerce/log/server.log kvcldprdapp02a 1 8
106283305 /jboss/server/20cap/log/server.log kvcldprdapp01b 1
147093787 /jboss/server/13commerce/log/server.log kvcldprdapp08b 1
569279529 /jboss/server/11commerce/log/server.log kvcldprdapp01a 2
670563206 /jboss/server/13commerce/log/server.log kvcldprdapp03b 1
862422991 /jboss/server/12commerce/log/server.log kvcldprdapp07b 1
038357748 /jboss/server/12commerce/log/server.log kvcldprdapp03b 1

Re: How to add a separate column which displays the total of the count?

somesoni2 — Fri, 09 Oct 2015 19:38:39 GMT

Try this

…..My Search…… | stats count by orderid,source,host | eventstats sum(count) as Total_Count

Re: How to add a separate column which displays the total of the count?

rroberts — Fri, 09 Oct 2015 20:37:10 GMT

Have you tried adding ... | appendpipe [stats sum(count) as Total_Count]

Re: How to add a separate column which displays the total of the count?

somesoni2 — Fri, 09 Oct 2015 21:31:34 GMT

Appendpipe will add a row with total, not the Total as separate column

Re: How to add a separate column which displays the total of the count?

rroberts — Fri, 09 Oct 2015 21:49:22 GMT

Yes, but you'll get the total repeated on each row with eventstats. I think he only wants the grand total displayed once?

Re: How to add a separate column which displays the total of the count?

somesoni2 — Fri, 09 Oct 2015 22:01:40 GMT

Well I may be wrong with interpretation of his requirement. And when I look at the expected output, yes that's misleading.
Guess it upto @pravanae, to decide which format he wanted.

Re: How to add a separate column which displays the total of the count?

rroberts — Fri, 09 Oct 2015 22:04:07 GMT

Indeed. I could be wrong too!