Splunk Search

How to count total with only displaying one stat?

jialiu907
Path Finder

I am looking to display only one statistic row being named Total with the count of all of the hosts added up, which should equal around 450, give or take. I know how to add it up in the way of using addcoltotals but I am only looking for the Total row, excluding the rest of the stats.

I have attached the base search and the current output. 

index=os source=ps host=deml* OR host=sefs* OR host=ingg* OR host=us* OR host=gblc* 
NOT user=dcv NOT user=root NOT user=chrony NOT user=dbus NOT user=gdm NOT user=libstor+ NOT user=nslcd NOT user=polkitd NOT user=postfix NOT user=rpc NOT user=rpcuser NOT user=rtkit NOT user=colord NOT user=nobody NOT user=sgeadmin NOT user=splunk NOT user=setroub+ NOT user=lp NOT user=68 NOT user=ntp NOT user=smmsp NOT user=dcvsmagent NOT user=libstoragemgmt
| dedup user
| stats count by host

jialiu907_0-1686064924390.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jialiu907,

if you want the total number of distinct hosts, you can use

| stats dc(host) AS host_count

ciao.

Giuseppe

0 Karma

jialiu907
Path Finder

Hey, so that gives me the count of the hosts, but what I am really looking for is to count up all of the numbers on the right side and have one total count of that without doing addcoltotals.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...