Splunk Enterprise

Sum of Total count in another column

goringop
Explorer

Hi 

Need help on my query, I want to achieve this kind of table shown below

What I want is to get the total_count value for each app by adding the values under count and get sum of it under total_count

 

appdest_portcounttotal_count
ssl10001
10020
13000
13006
22790
26107
443
44345
4
21
2
3
2
8
19
22
55
323
?
web-browsing

1000
21
443
5000
7788
80
8003
8080

2
3
4
7
1000
200
12
21
?

 

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Sorry.  I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help.  Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this: 

... | mvstats sum count as total_count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

An eval should do it.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(count)
---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway 

it seems that the count for each dest_port where gone, then Im getting the total_count with a value of 1

goringop_0-1596637374491.png

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try getting the total count from dest_port.

| stats values(dest_port) as dest_port count(bytes) as count by app
| eval total_count = mvcount(dest_port)

 

---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway thanks for the reply but still not getting the correct value. please see below screenshot. Under the count column, I want to see all the value for each port then Under the total_count column I want to see the sum of counts for that specific app

goringop_0-1596638220253.png

 

 

0 Karma

goringop
Explorer

@richgalloway 

a table something like this:

appdest_portcounttotal_count
ssl10001
10020
13000
13006
22790
26107
443
44345
4
21
2
3
2
8
19
22
55
323
455
web-browsing

1000
21
443
5000
7788
80
8003
8080

2
3
4
7
1000
200
12
21
1249
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry.  I misunderstood the request and read "total count" as a literal count.

I wrote an app that may help.  Check out the mvstats app at https://splunkbase.splunk.com/app/5198/

Use it like this: 

... | mvstats sum count as total_count
---
If this reply helps you, Karma would be appreciated.

goringop
Explorer

@richgalloway thank you for this, I will install the app and get back to you

0 Karma

goringop
Explorer

it works 🙂 thank you for your help

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...