Splunk Search

How do you get the count value by using tstats or stats command?

Communicator

Hi Team,

I am using the below command for getting the total value of Payable_Column & show the total count:

index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | addcoltotals

Example

Payable_Column Count
1 1
2 2
3 2

Required
Payable_Column Count
6 5

0 Karma

Contributor
index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats  sum(Payable_Column) as Payable_Column , sum(count) as count

is that what you want?

Sid

0 Karma

Communicator

@sdchakraborty Perfect but it is taking too much time to fetch data , i have 4000000 events. Can we expedite by using tstats command

0 Karma

Ultra Champion

You can use tstats if the fields in the command are index fields.

0 Karma

Communicator

but what be the command

| tstats index=ghl_gj sourcetype="Gaget" Period="Aug-18" | where date="2018-12-16" | stats count by Payable_Column | stats sum(Payable_Column) as Payable_Column , sum(count) as count

0 Karma