Splunk Search

How do you get the sum of columns by system?

Communicator

I am trying to figure out how to get the sum of systems_score column by systems. The data model is below:

systems               systems_score

System A                     20
System A                     10
System A                     0
System B                    20
System B                    20
System B                    20
System C                    10
System C                    15
System C                     0

How do I return the sum for each Systems - like below?

systems              systems_score_total

System A                          30
System B                          60
System C                          25
0 Karma
1 Solution

Champion

Hi @UMDTERPS

Try

|stats sum(systems_score) as systems_score_total by systems

View solution in original post

0 Karma

Champion

Hi @UMDTERPS

Try

|stats sum(systems_score) as systems_score_total by systems

View solution in original post

0 Karma

Communicator

Hey vnravikumar!

I tried your SPL and I got the following:

systems              systems_score_total

 System A                          
 System B                          
 System C                          

The systems_score total shows up blank. =(

0 Karma

Communicator

Hi Vnravikumar,

I had a mistype in the search bar, your solution works.

Thank you!

0 Karma

Champion

Welcome 🙂

0 Karma