Splunk Search

How do I add the values in a single row and three columns?

Bala
Explorer

stats count(eval(searchmatch(Bala))) as A count(eval(searchmatch(kasa))) as B count(eval(searchmatch(reddy))) as C 

A B C
1 2 3

 

now i want the total of these row values as single table

 

Total
6
Labels (1)
0 Karma
1 Solution

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

View solution in original post

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

0 Karma

venky1544
Builder

Hi @Bala 

Just use the rename command should work 

| addtotals |fields - A,B,C |rename Total as Failure

 

Note : PLease accept the solution if the reply worked for you it might help others as well 

0 Karma

Bala
Explorer

Yes, i got the result now i want to rename the total as Failure

And also what if i want to add only the B & C column values and A keep remain same.

ABC
123

 

Result should be

ATotal (rename it as count)
15
Tags (1)
0 Karma

venky1544
Builder

|makeresults |eval Name1="Bala",Name2="kasa",Name3="Reddy"
|append [|makeresults |eval Name2="kasa",Name3="Reddy"]
|append [|makeresults |eval Name3="Reddy"]|
stats count(eval(Name1="Bala")) AS A,count(eval(Name2="kasa")) AS B,count(eval(Name3="Reddy")) AS C | eval count=B+C |fields - B,C

0 Karma

Bala
Explorer

| addtotals 

will give  the results by adding one more column at the table like below

ABCTotal
1236

 

but i want it as single table , i want to dispaly the total as below

Total
6

 

0 Karma

venky1544
Builder

Hi @Bala 

use

| addtotals |fields -A,B,C  it should give you total 6

0 Karma

venky1544
Builder

 

FYI 

venky1544_1-1647012265053.png

 

 

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...