Splunk Search

How to add values and count of a field and use them in a stats command?

denisevw
Path Finder

Hi Splunkers

I need some assistance with a search. I need to add the values of a Field and then use them in a stats command.

The field name is "MyField" and the values and Count are:
Requests 389
Advices 233

I need to add Requests and Advices together and then use them in a stats command as Field "MyFieldTotals"

Thanks in advance

Tags (3)
1 Solution

ankireddy007
Path Finder

HI,

You are looking for something like this:

<Your Search> |eval MyFieldTotals=Requests+Advices | <Your Search>

View solution in original post

ankireddy007
Path Finder

HI,

You are looking for something like this:

<Your Search> |eval MyFieldTotals=Requests+Advices | <Your Search>

denisevw
Path Finder

That will rename the Field name, not the Value's name.

0 Karma

ankireddy007
Path Finder

You can rename using "rename"

|rename as

0 Karma

denisevw
Path Finder

Thanks for the response! It works but now the value returns as RequestsAdvices Can I rename it?

0 Karma
Get Updates on the Splunk Community!

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...