Splunk Search

Combine two stats count

cloud_cloud
Explorer

How to combine these two stats count into one?

... | stats count by operation

operation       count
added gid       3
deleted gid     2

... | stats count by gid

gid       count
10616     1
12757     1
16605     1
20458     1
22258     1

And I want these results:

operation     gid
added gid     10616
              12757
              20458
deleted gid   16605
              22258
Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

hi cloud_cloud

try

 | stats operation count by gid

cheers

View solution in original post

MuS
SplunkTrust
SplunkTrust

hi cloud_cloud

try

 | stats operation count by gid

cheers

cloud_cloud
Explorer

I've got Error in 'stats' command: The argument 'operation' is invalid.

But, after research on your answers I figured out correct command exactly what do I need! It's:
| stats values(gid) by operation

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...