Sum of Total count in another column

[goringop]

Hi 

Need help on my query, I want to achieve this kind of table shown below

What I want is to get the total_count value for each app by adding the values under count and get sum of it under total_count

app	dest_port	count	total_count
ssl	10001 10020 13000 13006 22790 26107 443 44345 4	21 2 3 2 8 19 22 55 323	?
web-browsing	1000 21 443 5000 7788 80 8003 8080	2 3 4 7 1000 200 12 21	?

[richgalloway]

An eval should do it.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(count)

[goringop]

@richgalloway 

it seems that the count for each dest_port where gone, then Im getting the total_count with a value of 1

[richgalloway]

Try getting the total count from dest_port.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(dest_port)

[goringop]

@richgalloway thanks for the reply but still not getting the correct value. please see below screenshot. Under the count column, I want to see all the value for each port then Under the total_count column I want to see the sum of counts for that specific app

[goringop]

@richgalloway 

a table something like this:

app	dest_port	count	total_count
ssl	10001 10020 13000 13006 22790 26107 443 44345 4	21 2 3 2 8 19 22 55 323	455
web-browsing	1000 21 443 5000 7788 80 8003 8080	2 3 4 7 1000 200 12 21	1249

[richgalloway · Accepted solution]

Sorry.  I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help.  Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this: 

... | mvstats sum count as total_count

[goringop]

@richgalloway thank you for this, I will install the app and get back to you

[goringop]

it works 🙂 thank you for your help