Splunk Search

How to count stats in columns?

sarit_s
Communicator

Hello
I have a table with 7 columns, some of them calculated from lookup
I want to count the total of one of the columns and then calculate percentage of other column based on the total
I tried this but im getting 0 results

 

| stats count by SERVERS 
| stats count(SERVERS) by Domain as "Domain_Count"
| eventstats sum(count) as Total_Servers

 

 What can I do ?
Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what you are trying to achieve with your sample code.

The first line reduces your columns to just 2 (SERVERS and count) - what about the other 5+ columns? do you still want these? are these to be added by lookups afterwards?

The second line doesn't work because Domain is no longer a column (removed by first line) - are you trying to count the number of servers in each domain?

Does this do what you want?

| eventstats count by SERVERS 
| eventstats dc(SERVERS) as Domain_Count by Domain
| eventstats dc(SERVERS) as Total_Servers
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...