Splunk Search

How to get the sum of multiple rows based on a different column?

dwear
Explorer

I have a CSV with 3 columns; Username, AD group, Logins (Logins being total number of logins for that user). I want to sum the number of total logins per Active Directory group. I started with:

|stats(count) by group

But that just gives me the number of times each group appears in the CSV (which generally equals the number of users in that group). How do I make it sum Logins per AD Group?

Any help is appreciated.

0 Karma
1 Solution

somesoni2
Revered Legend

Use this. Your question describe the solution

How do I make it sum Logins per AD Group?

your base search | stats sum(Logins) as count by group

View solution in original post

0 Karma

somesoni2
Revered Legend

Use this. Your question describe the solution

How do I make it sum Logins per AD Group?

your base search | stats sum(Logins) as count by group
0 Karma

dwear
Explorer

Thanks. The "as count" is what I was missing I guess.

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...