Splunk Search

How would I remove duplicates but add up their counts?

Ragate
Explorer

I have two sources of data. One that has an Account Name, License Key, and Account Revenue. The other has License Key and an Item_Count field.
Current it shows like this
LicenseKey Item_Count
200IGN3 4
200IGN3 10
342mD3D 8
342mD3D 6

I would like to remove the duplicate keys and add up there item counts.

How would this be done?
Thanks in advance.

0 Karma

somesoni2
Revered Legend

Try like this

your current search showing fields LicenseKey Item_Count
| stats sum(Item_Count) as Item_Count by LicenseKey
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...