- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
muebel

SplunkTrust
06-28-2010
01:35 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gkanapathy

Splunk Employee
06-28-2010
02:22 PM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gkanapathy

Splunk Employee
06-28-2010
02:22 PM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ftk
Motivator
06-28-2010
07:52 PM
That's way slicker than | metadata type=hosts index=foo | stats sum(totalCount)...awesome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bgagliardi1
Path Finder
10-05-2017
08:20 AM
I found this article just now because I wanted to do something similar, but i have dozens of indexes, and wanted a sum by index over X time.
index=* | chart count(index) by index | sort - count(index) | rename count(index) as "Sum of Events"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

earlhelms
Path Finder
10-26-2016
10:54 AM
6 years later, thanks!
