Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Hi, Can i use sum and list command in single q...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For example,
Category | CategoryGroup |Price
AAA|Apple |80
AAA|Apple |90
BBB|Banana|40
BBB|Butterfruit|90
I want to display my data as
Category|CategoryGroup|Total
AAA|Apple|170
BBB|Banana|40
|Butterfuit|90
Please advice.
I tried i can able to get the category and categorygroup in list however i cant do sum, but i can show as count.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @deepa_purushothaman - thanks for the upvote! If this solution works for you, will you accept it, so that other users can find it if they have the same question?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you elliotproebstel, this is helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, but this yields me duplicate value in Category. I want to include list command as well to eliminate show as multiple record under each category.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this!
(your search)|stats sum(Price) as Total by Category,CategoryGroup
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
