Splunk Search

How to create a sum of counts variable

vshakur
Path Finder

I have a query that ends with:

| eval error_message=mvindex(splited,0) | stats count as error_count by error_message | sort error_count desc | eval error_rate=round(error_count/(TOTAL_ERRORS)*100,0)

Which produces a table with 3 columns: | error_message | error_count | error_rate |

error_count represents the number of error_message occurrences for each error_message .

I'm trying to create a variable named TOTAL_ERRORS that would represent the total sum of all error_count values (the total number of all error_message occurrences of any type). I need the TOTAL_ERRORS variable in order to calculate the error_rate for each error_message.

I need help in creating this TOTAL_ERRORS variable.

I tried to do that with

stats sum(error_count)

which resulted in a table with a single row of the grand total.

I don't want TOTAL_ERRORS to have any effect on the table. I need it only for calculations.

Thank you,
Samuel

Tags (3)
0 Karma
1 Solution

gcusello
Legend

Hi
add to your search

| eventstats stats sum(error_count) AS Total 

and use it for your calculation.

Bye.
Giuseppe

View solution in original post

gcusello
Legend

Hi
add to your search

| eventstats stats sum(error_count) AS Total 

and use it for your calculation.

Bye.
Giuseppe

View solution in original post

vshakur
Path Finder

Thank you for your answer, but I'm getting the following error message:
Error in 'eventstats' command. The argument 'stats' is invalid

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

yeah, delete the word stats.

0 Karma

gcusello
Legend

Sorry!

| eventstats sum(error_count) AS Total 

Bye.
Giuseppe

0 Karma

vshakur
Path Finder

Thanks guys, it worked, but I got an extra unnecessary "Total" column in my table.
Ho do I get the Total without affecting the table.

0 Karma

gcusello
Legend

Add
| fields - Total
after the calculation.
If this answer solves your need, please accept it.
Bye.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!