Splunk Search

Count X's in each field in a table and total them in the last column

alferone
Explorer

Hello everyone, 

I have a table (generated from stats) that has several columns, and some values of those columns have "X's".  I would like to count those X's and total them in the last column of the table.  How would I go about doing that?  

Here is an example table, and thank you!

 

Field1 | Field2 | Field3 | Field4 | Field5 | Total_Xs
X      | X      | Foo    | Bar    | X      | 3
Foo2   | X      | Foo    | Bar    | X      | 2
X      | X      | X      | Bar    | X      | 4

 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The foreach command can do that.

<<your search>>
| eval Total_Xs = 0
| foreach * 
    [|  eval Total_Xs=Total_Xs + if('<<FIELD>>'="X", 1, 0)]

 

---
If this reply helps you, Karma would be appreciated.

alferone
Explorer

Thank you for the response!

So, I tried it, and it isn't working, but for more context:

I run a stats command for the table, and after that, I run a fillnull to insert the X's into the table.  I tried another stats after that, but that didn't work.

How would I append the "Total_X's" field to the table?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please elaborate on "it isn't working".  That doesn't give us anything to work with.  Show us what you get so we can offer other suggestions.

Use the eval command to add a field to the results table.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...