Splunk Search

Count X's in each field in a table and total them in the last column

alferone
Explorer

Hello everyone, 

I have a table (generated from stats) that has several columns, and some values of those columns have "X's".  I would like to count those X's and total them in the last column of the table.  How would I go about doing that?  

Here is an example table, and thank you!

 

Field1 | Field2 | Field3 | Field4 | Field5 | Total_Xs
X      | X      | Foo    | Bar    | X      | 3
Foo2   | X      | Foo    | Bar    | X      | 2
X      | X      | X      | Bar    | X      | 4

 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The foreach command can do that.

<<your search>>
| eval Total_Xs = 0
| foreach * 
    [|  eval Total_Xs=Total_Xs + if('<<FIELD>>'="X", 1, 0)]

 

---
If this reply helps you, Karma would be appreciated.

alferone
Explorer

Thank you for the response!

So, I tried it, and it isn't working, but for more context:

I run a stats command for the table, and after that, I run a fillnull to insert the X's into the table.  I tried another stats after that, but that didn't work.

How would I append the "Total_X's" field to the table?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "it isn't working".  That doesn't give us anything to work with.  Show us what you get so we can offer other suggestions.

Use the eval command to add a field to the results table.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...