Splunk Search

Could you help me with a stats(sum) query?

jip31
Motivator

hi

I use the code below in order to count some events from 3 fields:

(LogName SourceName Type )

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type | rename LogName as EventViewer_Source | sort  -count

Now I want to sum the different counts I have with the code above by LogName and by Type
I tried to do this but .....

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats sum(count) as Total by LogName, Type

Thanks

Tags (2)
0 Karma
1 Solution

493669
Super Champion

try this:

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type| eventstats sum(count) as total_count | rename LogName as EventViewer_Source | sort 0 -count

It will create new field as toal_count having sum of all count

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

not sure of this line - "Now I want to sum the differents counts i have with the code above by LogName and by Type"..
do you want to find out the difference between, the sum of counts by logname and by type?

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

No i want To count already done in the previous request by logname and type

0 Karma

493669
Super Champion

try this:

index="windows" (sourcetype="wineventlog:application" OR sourcetype="wineventlog:security" OR sourcetype="wineventlog:system" Type="Critique" OR Type="Avertissement") | stats count by LogName SourceName Type| eventstats sum(count) as total_count | rename LogName as EventViewer_Source | sort 0 -count

It will create new field as toal_count having sum of all count

0 Karma

jip31
Motivator

it works thanks but the good result is in the column count and not in the column total_count
i want to count by logname and by type and not to count all the logname and type

0 Karma

493669
Super Champion

then remove | eventstats sum(count) as total_count from query

0 Karma

jip31
Motivator

Thanks i Will test tomorrow

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...