Splunk Search

Adding Field Values Generated by a |stats latest(fieldvalue) command

jason_hotchkiss
Communicator

Hello -

 

I have the following search:

<base search>
| fields host registrations
| stats latest(registrations) by host

This produces the following table:

host       latest(registrations)
Pc1        51

Pc2        29

Pc3        18

How would I add the values of latest(registrations) to provide a single value for all 3 hosts?  For example, I would like only the sum of the latest registrations (98) to display in a single value panel.

 

Thank you!

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg
0 Karma

jason_hotchkiss
Communicator

Thank you!!  This worked for me.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...