Splunk Search

How do I add the values in a single row and three columns?

Bala
Explorer

stats count(eval(searchmatch(Bala))) as A count(eval(searchmatch(kasa))) as B count(eval(searchmatch(reddy))) as C 

A B C
1 2 3

 

now i want the total of these row values as single table

 

Total
6
Labels (1)
0 Karma
1 Solution

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

View solution in original post

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

0 Karma

venky1544
Builder

Hi @Bala 

Just use the rename command should work 

| addtotals |fields - A,B,C |rename Total as Failure

 

Note : PLease accept the solution if the reply worked for you it might help others as well 

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
Tags (1)
0 Karma

venky1544
Builder

|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy"
|append [|makeresults |eval Name2="kasa",Name3="Reddy"]
|append [|makeresults |eval Name3="Reddy"]|
stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C

0 Karma

Bala
Explorer

| addtotals 

will give  the results by adding one more column at the table like below

ABCTotal
1236

 

but i want it as single table , i want to dispaly the total as below

Total
6

 

0 Karma

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

0 Karma

venky1544
Builder

 

FYI 

venky1544_1-1647012265053.png

 

 

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...