Splunk Search

How can I add a Total for the count of events from different index or sourcetypes?

digital_alchemy
Path Finder

I'm searching blocked events from the firewall and Palo Alto logs and would like to add a line to show the Total of the two combined. I'm having trouble adding the line showing the total of the counts for the two individual indexes.

Current search:

index=firewalls OR index=paloalto action=blocked | stats count as "Blocked Events" by index

I would like the results to look like

firewalls 10
paloalto 25
total 35

Tags (2)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You should use addcoltotals

It will look something like this

| addcoltotals label=Total labelfield=status

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

You should use addcoltotals

It will look something like this

| addcoltotals label=Total labelfield=status

digital_alchemy
Path Finder

Thanks.. this works

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...