How to add two field values count to another field value?

[pranay_adla]

I would like to add splunkd count and splunkd_access count as splunkd_total. Remaining table should look like this only. Can anyone help on this.

[vnravikumar · Accepted solution]

Hi

Try this

index=_internal |eval sourcetype = if(sourcetype =="splunkd" OR sourcetype =="splunkd_access","splunkd_total",sourcetype)
| stats count by sourcetype

[pranay_adla]

Thanks Ravi,

Same way can we subtract splunkd_access count from splunkd count?

[vnravikumar]

Give a try

index=_internal 
| stats count by sourcetype 
| transpose 0 header_field=sourcetype 
| eval splunkd_total = splunkd + splunkd_access 
| eval splunkd_diff = splunkd - splunkd_access 
| fields - splunkd, splunkd_access 
| transpose 
| where column !="column"

[pranay_adla]

ravi small help if my field looks like this "HL7 - Its Duplicate Y". Eval not working can give me solution

[vnravikumar]

try with single quote 'HL7 - Its Duplicate Y'

[pranay_adla]

Not working '-' accepts only number's getting this message

[pranay_adla]

thank worked

[kamlesh_vaghela]

@pranay_adla

Is that what you looking for?

index=_internal | stats count by sourcetype | replace splunkd* with splunkd_total in sourcetype | stats sum(count) as count by sourcetype