Splunk Search

Get a total for a multivalue field by multiple fields



I'm trying to get multiple totals for multiple fields. My current query incorporates

| stats count as Count by Status StatusTxt, I'm trying to add the total for each StatusTxt to my results.

Status StatusTxt Count
01 Complete 20
02 Complete 25
Total 45
01 Incomplete 10
02 Incomplete 12
Total 22

0 Karma


I resolved my issue by adjusting my search to look for one value at a time w/ the addcoltotals. Then appended the search again looking for the second value and then created an eval to sort them. Then I sorted off of the eval.

I'm sure there is a more eloquent solution but this was time-sensitive and it got the job done.

0 Karma

Super Champion

Try this :

| stats count as Count by Status StatusTxt | eventstats sum(Count) as Total_Count by StatusTxt

It will give you total count for each StatusTxt

If you are only interested in Total count of StatusTxt then you should try:

| stats count as Count by StatusTxt
0 Karma


This does not look multi valued fields, you have 1 row for each event
why not use |stats sum(Count) by StatusTxt

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...