Splunk Search

How to edit my search to add a column with the total for each list(count) by a field?

rubeniturrieta
Communicator

Hi to everyone

I have this search:

sourcetype="cisco:asa" | stats count by src_ip,dest_ip | sort -count |  stats list(dest_ip),list(count) by src_ip

With this output:

alt text

I need to add a column with the total count by src_ip (sum of all the count for each list(count) value)

Does someone knows how to do this?

regards

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

 sourcetype="cisco:asa" | stats count by src_ip,dest_ip | sort -count | eventstats sum(count) as Total by src_ip |  stats list(dest_ip),list(count) values(Total) as Total by src_ip

View solution in original post

somesoni2
Revered Legend

Try something like this

 sourcetype="cisco:asa" | stats count by src_ip,dest_ip | sort -count | eventstats sum(count) as Total by src_ip |  stats list(dest_ip),list(count) values(Total) as Total by src_ip

rubeniturrieta
Communicator

Very well, it's working, thanks you very much!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...