Splunk Search

How to count total with only displaying one stat?

jialiu907
Path Finder

I am looking to display only one statistic row being named Total with the count of all of the hosts added up, which should equal around 450, give or take. I know how to add it up in the way of using addcoltotals but I am only looking for the Total row, excluding the rest of the stats.

I have attached the base search and the current output. 

index=os source=ps host=deml* OR host=sefs* OR host=ingg* OR host=us* OR host=gblc* 
NOT user=dcv NOT user=root NOT user=chrony NOT user=dbus NOT user=gdm NOT user=libstor+ NOT user=nslcd NOT user=polkitd NOT user=postfix NOT user=rpc NOT user=rpcuser NOT user=rtkit NOT user=colord NOT user=nobody NOT user=sgeadmin NOT user=splunk NOT user=setroub+ NOT user=lp NOT user=68 NOT user=ntp NOT user=smmsp NOT user=dcvsmagent NOT user=libstoragemgmt
| dedup user
| stats count by host

jialiu907_0-1686064924390.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jialiu907,

if you want the total number of distinct hosts, you can use

| stats dc(host) AS host_count

ciao.

Giuseppe

0 Karma

jialiu907
Path Finder

Hey, so that gives me the count of the hosts, but what I am really looking for is to count up all of the numbers on the right side and have one total count of that without doing addcoltotals.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...