Splunk Search

How to count stats in columns?

sarit_s
Communicator

Hello
I have a table with 7 columns, some of them calculated from lookup
I want to count the total of one of the columns and then calculate percentage of other column based on the total
I tried this but im getting 0 results

 

| stats count by SERVERS 
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers

 

 What can I do ?
Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...