Splunk Search

How do I add the count of string values in each row?

477450
Explorer

Hi guys,

If I want to add the total values from each row, I can use the command | addtotal and this is only used to add numeric values, but if I want to add the number of string values from each row, which command can I use....? I want my output to be like this.

host   field1   field2   field2   Total
h1    abc     efg      ghi     3
h2   jkl      mno               2
h3             pqr              1

Thanks in advance

0 Karma
1 Solution

477450
Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count

View solution in original post

0 Karma

477450
Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count
0 Karma

somesoni2
Revered Legend

Try something like this

YOur current search giving example output (without Total) | untable host metric value | appendpipe [| stats dc(value) as value by host | eval metric="Total" ] | chart values(*) over host by metric | table host * Total
0 Karma

477450
Explorer

Thanks buddy ..but this is adding each character of the string, i want the total of all the fields values in a single row.

0 Karma

somesoni2
Revered Legend

My bad, was using the wrong column in the appendpipe. Just updated. See if that works.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...