Splunk Search

Get a total for a multivalue field by multiple fields



I'm trying to get multiple totals for multiple fields. My current query incorporates

| stats count as Count by Status StatusTxt, I'm trying to add the total for each StatusTxt to my results.

Status StatusTxt Count
01 Complete 20
02 Complete 25
Total 45
01 Incomplete 10
02 Incomplete 12
Total 22

0 Karma


I resolved my issue by adjusting my search to look for one value at a time w/ the addcoltotals. Then appended the search again looking for the second value and then created an eval to sort them. Then I sorted off of the eval.

I'm sure there is a more eloquent solution but this was time-sensitive and it got the job done.

0 Karma

Super Champion

Try this :

| stats count as Count by Status StatusTxt | eventstats sum(Count) as Total_Count by StatusTxt

It will give you total count for each StatusTxt

If you are only interested in Total count of StatusTxt then you should try:

| stats count as Count by StatusTxt
0 Karma


This does not look multi valued fields, you have 1 row for each event
why not use |stats sum(Count) by StatusTxt

0 Karma
Get Updates on the Splunk Community!

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...