- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jason_hotchkiss
Communicator
11-02-2020
09:09 AM
Hello -
I have the following search:
<base search>
| fields host registrations
| stats latest(registrations) by host
This produces the following table:
host latest(registrations)
Pc1 51
Pc2 29
Pc3 18
How would I add the values of latest(registrations) to provide a single value for all 3 hosts? For example, I would like only the sum of the latest registrations (98) to display in a single value panel.
Thank you!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-02-2020
09:14 AM
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-02-2020
09:14 AM
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jason_hotchkiss
Communicator
11-02-2020
09:16 AM
Thank you!! This worked for me.
