Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Hi, Can i use sum and list command in single q...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For example,
Category | CategoryGroup |Price
AAA|Apple |80
AAA|Apple |90
BBB|Banana|40
BBB|Butterfruit|90
I want to display my data as
Category|CategoryGroup|Total
AAA|Apple|170
BBB|Banana|40
|Butterfuit|90
Please advice.
I tried i can able to get the category and categorygroup in list however i cant do sum, but i can show as count.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, you can simply add the stats list() after the sum:
your search| stats sum(Price) AS Total BY Category,CategoryGroup | stats list(CategoryGroup) AS CategoryGroup list(Total) AS Total BY Category
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @deepa_purushothaman - thanks for the upvote! If this solution works for you, will you accept it, so that other users can find it if they have the same question?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you elliotproebstel, this is helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you, but this yields me duplicate value in Category. I want to include list command as well to eliminate show as multiple record under each category.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this!
(your search)|stats sum(Price) as Total by Category,CategoryGroup
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
