Splunk Enterprise

Sum of Total count in another column

goringop
Explorer

Hi 

Need help on my query, I want to achieve this kind of table shown below

What I want is to get the total_count value for each app by adding the values under count and get sum of it under total_count

 

appdest_portcounttotal_count
ssl10001
10020
13000
13006
22790
26107
443
44345
4
21
2
3
2
8
19
22
55
323
?
web-browsing

1000
21
443
5000
7788
80
8003
8080

2
3
4
7
1000
200
12
21
?

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Sorry.  I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help.  Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this: 

... | mvstats sum count as total_count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

An eval should do it.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(count)
---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway 

it seems that the count for each dest_port where gone, then Im getting the total_count with a value of 1

goringop_0-1596637374491.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try getting the total count from dest_port.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(dest_port)

 

---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway thanks for the reply but still not getting the correct value. please see below screenshot. Under the count column, I want to see all the value for each port then Under the total_count column I want to see the sum of counts for that specific app

goringop_0-1596638220253.png

 

 

0 Karma

goringop
Explorer

@richgalloway 

a table something like this:

appdest_portcounttotal_count
ssl10001
10020
13000
13006
22790
26107
443
44345
4
21
2
3
2
8
19
22
55
323
455
web-browsing

1000
21
443
5000
7788
80
8003
8080

2
3
4
7
1000
200
12
21
1249
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry.  I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help.  Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this: 

... | mvstats sum count as total_count
---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway thank you for this, I will install the app and get back to you

0 Karma

goringop
Explorer

it works 🙂 thank you for your help

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...