How do you get the count value by using tstats or stats command?

[rakesh44]

Hi Team,

I am using the below command for getting the total value of Payable_Column & show the total count:

index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | addcoltotals

Example

Payable_Column Count
1 1
2 2
3 2

Required
Payable_Column Count
6 5

[sdchakraborty]

index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats  sum(Payable_Column) as Payable_Column , sum(count) as count

is that what you want?

Sid

[rakesh44]

@sdchakraborty Perfect but it is taking too much time to fetch data , i have 4000000 events. Can we expedite by using tstats command

[ddrillic]

You can use tstats if the fields in the command are index fields.

[rakesh44]

but what be the command

| tstats index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats sum(Payable_Column) as Payable_Column , sum(count) as count