Splunk Search

Combine two stats count

cloud_cloud
Explorer

How to combine these two stats count into one?

... | stats count by operation

operation       count
added gid       3
deleted gid     2

... | stats count by gid

gid       count
10616     1
12757     1
16605     1
20458     1
22258     1

And I want these results:

operation     gid
added gid     10616
              12757
              20458
deleted gid   16605
              22258
Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

hi cloud_cloud

try

 | stats operation count by gid

cheers

View solution in original post

MuS
SplunkTrust
SplunkTrust

hi cloud_cloud

try

 | stats operation count by gid

cheers

cloud_cloud
Explorer

I've got Error in 'stats' command: The argument 'operation' is invalid.

But, after research on your answers I figured out correct command exactly what do I need! It's:
| stats values(gid) by operation

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...