Splunk Search

Get a total for a multivalue field by multiple fields



I'm trying to get multiple totals for multiple fields. My current query incorporates

| stats count as Count by Status StatusTxt, I'm trying to add the total for each StatusTxt to my results.

Status StatusTxt Count
01 Complete 20
02 Complete 25
Total 45
01 Incomplete 10
02 Incomplete 12
Total 22

0 Karma


I resolved my issue by adjusting my search to look for one value at a time w/ the addcoltotals. Then appended the search again looking for the second value and then created an eval to sort them. Then I sorted off of the eval.

I'm sure there is a more eloquent solution but this was time-sensitive and it got the job done.

0 Karma

Super Champion

Try this :

| stats count as Count by Status StatusTxt | eventstats sum(Count) as Total_Count by StatusTxt

It will give you total count for each StatusTxt

If you are only interested in Total count of StatusTxt then you should try:

| stats count as Count by StatusTxt
0 Karma


This does not look multi valued fields, you have 1 row for each event
why not use |stats sum(Count) by StatusTxt

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...