How to create a sum of counts variable

[vshakur]

I have a query that ends with:

| eval error_message=mvindex(splited,0) | stats count as error_count by error_message | sort error_count desc | eval error_rate=round(error_count/(TOTAL_ERRORS)*100,0)

Which produces a table with 3 columns: | error_message | error_count | error_rate |

error_count represents the number of error_message occurrences for each error_message .

I'm trying to create a variable named TOTAL_ERRORS that would represent the total sum of all error_count values (the total number of all error_message occurrences of any type). I need the TOTAL_ERRORS variable in order to calculate the error_rate for each error_message.

I need help in creating this TOTAL_ERRORS variable.

I tried to do that with

stats sum(error_count)

which resulted in a table with a single row of the grand total.

I don't want TOTAL_ERRORS to have any effect on the table. I need it only for calculations.

Thank you,
Samuel

[gcusello · Accepted solution]

Hi
add to your search

| eventstats stats sum(error_count) AS Total 

and use it for your calculation.

Bye.
Giuseppe

[vshakur]

Thank you for your answer, but I'm getting the following error message:
Error in 'eventstats' command. The argument 'stats' is invalid

[DalJeanis]

yeah, delete the word stats.

[gcusello]

Sorry!

| eventstats sum(error_count) AS Total 

Bye.
Giuseppe

[vshakur]

Thanks guys, it worked, but I got an extra unnecessary "Total" column in my table.
Ho do I get the Total without affecting the table.

[gcusello]

Add
| fields - Total
after the calculation.
If this answer solves your need, please accept it.
Bye.
Giuseppe