Splunk Search

How to get sum of a specific field using eval

mjlsnombrado
Communicator

index=sampleidx
|stats count(eval(value="1")) as total1

How to do this using eval?

0 Karma
1 Solution

493669
Super Champion

Try this:

index=sampleidx
|eventstats count(eval(value="1")) as total1 count(eval(value="2")) as total2|eval total = total1/total2
|stats avg(total) as average by sample

View solution in original post

493669
Super Champion

Try this:

index=sampleidx
|eventstats count(eval(value="1")) as total1 count(eval(value="2")) as total2|eval total = total1/total2
|stats avg(total) as average by sample

mjlsnombrado
Communicator

Thats it thanks 🙂

0 Karma

493669
Super Champion

Try this:

index=sampleidx value="1"|stats count as total1
0 Karma

mjlsnombrado
Communicator

no I cant use that, because I want to get the total count of a specific field value and then get the average for example
|eval totalcount1= (total of value="1")
|eval totalcount2 = (total of value="2")
|eval total = totalcount1/totalcount2
|stats avg(total) as average by sample

0 Karma

493669
Super Champion

why you want to use eval instead of stats ....as stats is better to use

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...