Splunk Search

How to count stats in columns?

sarit_s
Communicator

Hello
I have a table with 7 columns, some of them calculated from lookup
I want to count the total of one of the columns and then calculate percentage of other column based on the total
I tried this but im getting 0 results

 

| stats count by SERVERS 
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers

 

 What can I do ?
Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...