Splunk Search

Groups in stats command: How to get the sum of multiple fields by a field?

splunkuser320
Path Finder

I am trying to create a query to get the sum of multiple fields by a field. 

 

index="*****"
|stats sum(field_A) as  A by field_C,sum(field_B) as B  by field_C

| table field_C, field_A,field_B

 

This query is giving error. 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @splunkuser320,

you cannot use two BY clauses in a stats command, please try this:

index="*****"
| stats sum(field_A) AS field_A sum(field_B) AS field_B BY field_C

Ciao.

Giuseppe

View solution in original post

splunkuser320
Path Finder

Thanks for quick help 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunkuser320,

you cannot use two BY clauses in a stats command, please try this:

index="*****"
| stats sum(field_A) AS field_A sum(field_B) AS field_B BY field_C

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...