Splunk Search

How to add counts and sum from different fields

amal1234
Engager

Hi,

New to Splunk and still trying to get to grips with it. I am trying to present a single table with the following coloumns:
- a list of Services
- a count of these services
- add up all the numbers of a specific field (NumberOfCalls) for each of these services

This is the query I am running:

*Base Query*
| stats count by Service NumberOfCalls

This outputs the following, which is counting the NumberOfCalls - not the Service so there are duplicate Services:

Service NumberOfCalls   count
UAT2        1           2
UAT6        1           5
UAT6        4           2

What is should look like it this (counting the service and adding all the NumberOfCalls per service)

Service NumberOfCalls   count
UAT2        2           2
UAT6        13          7

I know the search query is very basic but I have tried numerous variations, and all are wrong.

Any suggestions please on how I can get this to work? Hope it all makes sense!

Thanks,
AM

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try *Base Query* | stats count, sum(NumberOfCalls) as NumberOfCalls by Service.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try *Base Query* | stats count, sum(NumberOfCalls) as NumberOfCalls by Service.

---
If this reply helps you, Karma would be appreciated.

amal1234
Engager

Thanks. Such a simple solution, I almost feel silly asking!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...