Splunk Search

How do I add the values in a single row and three columns?

Bala
Explorer

stats count(eval(searchmatch(Bala))) as A count(eval(searchmatch(kasa))) as B count(eval(searchmatch(reddy))) as C 

A B C
1 2 3

 

now i want the total of these row values as single table

 

Total
6
Labels (1)
0 Karma
1 Solution

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

View solution in original post

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

0 Karma

venky1544
Builder

Hi @Bala 

Just use the rename command should work 

| addtotals |fields - A,B,C |rename Total as Failure

 

Note : PLease accept the solution if the reply worked for you it might help others as well 

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
Tags (1)
0 Karma

venky1544
Builder

|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy"
|append [|makeresults |eval Name2="kasa",Name3="Reddy"]
|append [|makeresults |eval Name3="Reddy"]|
stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C

0 Karma

Bala
Explorer

| addtotals 

will give  the results by adding one more column at the table like below

ABCTotal
1236

 

but i want it as single table , i want to dispaly the total as below

Total
6

 

0 Karma

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

0 Karma

venky1544
Builder

 

FYI 

venky1544_1-1647012265053.png

 

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...