I would like to add splunkd count and splunkd_access count as splunkd_total. Remaining table should look like this only. Can anyone help on this.
Hi
Try this
index=_internal |eval sourcetype = if(sourcetype =="splunkd" OR sourcetype =="splunkd_access","splunkd_total",sourcetype)
| stats count by sourcetype
Hi
Try this
index=_internal |eval sourcetype = if(sourcetype =="splunkd" OR sourcetype =="splunkd_access","splunkd_total",sourcetype)
| stats count by sourcetype
Thanks Ravi,
Same way can we subtract splunkd_access count from splunkd count?
Give a try
index=_internal
| stats count by sourcetype
| transpose 0 header_field=sourcetype
| eval splunkd_total = splunkd + splunkd_access
| eval splunkd_diff = splunkd - splunkd_access
| fields - splunkd, splunkd_access
| transpose
| where column !="column"
ravi small help if my field looks like this "HL7 - Its Duplicate Y". Eval not working can give me solution
try with single quote 'HL7 - Its Duplicate Y'
Not working '-' accepts only number's getting this message
thank worked
@pranay_adla
Is that what you looking for?
index=_internal | stats count by sourcetype | replace splunkd* with splunkd_total in sourcetype | stats sum(count) as count by sourcetype