How to include the count of unique error strings and the count of each error string in my alert email/PDF?

[AmitKrJash]

Hi,

I have created a Splunk alert where it is taking the error strings from the log files and grouping the similar strings and giving the count of particular error strings. This alert is running for every 24 hours.

This is the search:

index=abc sourcetype=xyz error earliest=-24h@h latest=now| rex field=_raw "\] - (?[^|]+).*"| stats count by CompleteErrorString

So the final output is something like this:

CompleteErrorString                                                count

Client is not configured properly in the database                   22
Client is not having enough permission to access the application     7
SOAP Fault occurred                                                 14

So these are the three different error strings that got generated in the last 24 hours with their respective counts (number of times the string appeared in the log files) and I'm getting this whole output in an attached PDF which I had selected while creating the alert. Now my question: is there a way to get the total count of different error strings that are getting generated in the log files (here it is 3) along with the above output either in the attached PDF or in the alert mail body. When I am modifying the above search as:

index=abc sourcetype=xyz error earliest=-24h@h latest=now| rex field=_raw "\] - (?[^|]+).*"| stats count by CompleteErrorString|stats count as "Count of different error strings"

I am getting only the output as

Count of different error strings
3

But I want the combined output as something like this in the attached PDF or in the alert mail body:

Count of different error strings
3

CompleteErrorString                                                 count

Client is not configured properly in the database                     22
Client is not having enough permission to access the application       7
SOAP Fault occurred                                                   14

Any help on this will be greatly appreciated.

[somesoni2]

Will something like this work for you??

index=abc sourcetype=xyz error earliest=-24h@h latest=now| rex field=_raw "\] - (?[^|]+).*"| stats count by CompleteErrorString | appendpipe [stats sum(count) as count | eval CompleteErrorString="Total Count of different error strings"] 

Output

CompleteErrorString                                                 count

 Client is not configured properly in the database                     22
 Client is not having enough permission to access the application       7
 SOAP Fault occurred                                                   14
Total Count of different error strings                                 43