Splunk Search

How to create a sum of counts variable

vshakur
Path Finder

I have a query that ends with:

| eval error_message=mvindex(splited,0) | stats count as error_count by error_message | sort error_count desc | eval error_rate=round(error_count/(TOTAL_ERRORS)*100,0)

Which produces a table with 3 columns: | error_message | error_count | error_rate |

error_count represents the number of error_message occurrences for each error_message .

I'm trying to create a variable named TOTAL_ERRORS that would represent the total sum of all error_count values (the total number of all error_message occurrences of any type). I need the TOTAL_ERRORS variable in order to calculate the error_rate for each error_message.

I need help in creating this TOTAL_ERRORS variable.

I tried to do that with

stats sum(error_count)

which resulted in a table with a single row of the grand total.

I don't want TOTAL_ERRORS to have any effect on the table. I need it only for calculations.

Thank you,
Samuel

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi
add to your search

| eventstats stats sum(error_count) AS Total 

and use it for your calculation.

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi
add to your search

| eventstats stats sum(error_count) AS Total 

and use it for your calculation.

Bye.
Giuseppe

vshakur
Path Finder

Thank you for your answer, but I'm getting the following error message:
Error in 'eventstats' command. The argument 'stats' is invalid

0 Karma

DalJeanis
Legend

yeah, delete the word stats.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Sorry!

| eventstats sum(error_count) AS Total 

Bye.
Giuseppe

0 Karma

vshakur
Path Finder

Thanks guys, it worked, but I got an extra unnecessary "Total" column in my table.
Ho do I get the Total without affecting the table.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Add
| fields - Total
after the calculation.
If this answer solves your need, please accept it.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...