Splunk Search

How can I add a Total for the count of events from different index or sourcetypes?

digital_alchemy
Path Finder

I'm searching blocked events from the firewall and Palo Alto logs and would like to add a line to show the Total of the two combined. I'm having trouble adding the line showing the total of the counts for the two individual indexes.

Current search:

index=firewalls OR index=paloalto action=blocked | stats count as "Blocked Events" by index

I would like the results to look like

firewalls 10
paloalto 25
total 35

Tags (2)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You should use addcoltotals

It will look something like this

| addcoltotals label=Total labelfield=status

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

You should use addcoltotals

It will look something like this

| addcoltotals label=Total labelfield=status

digital_alchemy
Path Finder

Thanks.. this works

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...