Splunk Search

How do I add the count of string values in each row?

Explorer

Hi guys,

If I want to add the total values from each row, I can use the command | addtotal and this is only used to add numeric values, but if I want to add the number of string values from each row, which command can I use....? I want my output to be like this.

host   field1   field2   field2   Total
h1    abc     efg      ghi     3
h2   jkl      mno               2
h3             pqr              1

Thanks in advance

0 Karma
1 Solution

Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count

View solution in original post

0 Karma

Explorer

The exact answer is this

base search |eval count=if(field1!=" ",1,0) |eval count=count+if(field2!=" ",1,0)|eval count=count+if(field3!=" ",1,0)|eval count=count+if(field4!=" ",1,0)|table host field1 field2 field3 field4 count

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try something like this

YOur current search giving example output (without Total) | untable host metric value | appendpipe [| stats dc(value) as value by host | eval metric="Total" ] | chart values(*) over host by metric | table host * Total
0 Karma

Explorer

Thanks buddy ..but this is adding each character of the string, i want the total of all the fields values in a single row.

0 Karma

SplunkTrust
SplunkTrust

My bad, was using the wrong column in the appendpipe. Just updated. See if that works.

0 Karma