Splunk Search

How to add the values of a column and show the result as a separate field?

vrmandadi
Builder

Hello Expebrts,

I am trying to add the values of a column and show the result in another field, but I am not able to generate it.

Example:

index=abc |stats count by name 

Current Output:
a_req 4
a_resp 2
b_req 5
b_resp 5

Desired Output:
a 6

b 10

It should add a_req and a_resp and show a result in new column with the aggregate values

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The current search is counting name. If you want to count by a different field, you have to specify that field (and create it, if necessary). Try this:

index=abc | rex field=name "(?<aggrName>\w+)_" | stats count by aggrName
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The current search is counting name. If you want to count by a different field, you have to specify that field (and create it, if necessary). Try this:

index=abc | rex field=name "(?<aggrName>\w+)_" | stats count by aggrName
---
If this reply helps you, Karma would be appreciated.

vrmandadi
Builder

Thanks richgalloway

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...