Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Hi, Can i use sum and list command in single q...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For example,
Category | CategoryGroup |Price
AAA|Apple |80
AAA|Apple |90
BBB|Banana|40
BBB|Butterfruit|90
I want to display my data as
Category|CategoryGroup|Total
AAA|Apple|170
BBB|Banana|40
|Butterfuit|90
Please advice.
I tried i can able to get the category and categorygroup in list however i cant do sum, but i can show as count.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @deepa_purushothaman - thanks for the upvote! If this solution works for you, will you accept it, so that other users can find it if they have the same question?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you elliotproebstel, this is helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, but this yields me duplicate value in Category. I want to include list command as well to eliminate show as multiple record under each category.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this!
(your search)|stats sum(Price) as Total by Category,CategoryGroup
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
