Splunk Search

How do I add the values in a single row and three columns?

Bala
Explorer

stats count(eval(searchmatch(Bala))) as A count(eval(searchmatch(kasa))) as B count(eval(searchmatch(reddy))) as C 

A B C
1 2 3

 

now i want the total of these row values as single table

 

Total
6
Labels (1)
0 Karma
1 Solution

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

View solution in original post

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

0 Karma

venky1544
Builder

Hi @Bala 

Just use the rename command should work 

| addtotals |fields - A,B,C |rename Total as Failure

 

Note : PLease accept the solution if the reply worked for you it might help others as well 

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
Tags (1)
0 Karma

venky1544
Builder

|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy"
|append [|makeresults |eval Name2="kasa",Name3="Reddy"]
|append [|makeresults |eval Name3="Reddy"]|
stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C

0 Karma

Bala
Explorer

| addtotals 

will give  the results by adding one more column at the table like below

ABCTotal
1236

 

but i want it as single table , i want to dispaly the total as below

Total
6

 

0 Karma

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

0 Karma

venky1544
Builder

 

FYI 

venky1544_1-1647012265053.png

 

 

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...