Splunk Search

Get a total for a multivalue field by multiple fields



I'm trying to get multiple totals for multiple fields. My current query incorporates

| stats count as Count by Status StatusTxt, I'm trying to add the total for each StatusTxt to my results.

Status StatusTxt Count
01 Complete 20
02 Complete 25
Total 45
01 Incomplete 10
02 Incomplete 12
Total 22

0 Karma


I resolved my issue by adjusting my search to look for one value at a time w/ the addcoltotals. Then appended the search again looking for the second value and then created an eval to sort them. Then I sorted off of the eval.

I'm sure there is a more eloquent solution but this was time-sensitive and it got the job done.

0 Karma

Super Champion

Try this :

| stats count as Count by Status StatusTxt | eventstats sum(Count) as Total_Count by StatusTxt

It will give you total count for each StatusTxt

If you are only interested in Total count of StatusTxt then you should try:

| stats count as Count by StatusTxt
0 Karma


This does not look multi valued fields, you have 1 row for each event
why not use |stats sum(Count) by StatusTxt

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...