The stats XXX by YYY will do aggregations to group by YYY and you can include more than one field to group by.
Can you explain a bit more exactly what you are trying to do with the data you have
select
coalesce(class,"total") as class,
coalesce(name,"total") as name,
sum(num) as sum
from table a
group by grouping sets (class,name,(class,name))
In mysql I can get sum from each group and a total at the same time, from the left table to the right one.
can I do the same in Splunk?
The answer is always YES with Splunk 😀 and often there is more than one way to achieve the same result.
Here is an example with your data setup (note that in your data example, your C2/C sum is shown as '3' in the right table, however, from the data in the left, it should be 4, right?
| makeresults
| eval _raw="Class,name,number
C1,A,1
C1,B,2
C2,C,1
C1,A,1
C1,B,2
C2,C,3"
| multikv forceheader=1
| table Class,name,number
| stats sum(number) as sum by Class name
| addcoltotals labelfield="Class"
| appendpipe [
| stats sum(sum) as sum by Class
]
so in this example, up to multikv is setting up the sample data from your left hand table, then:
the first stats sum... is calculating the totals by Class/name to give you 3 rows. Then addcoltotals is giving the total for those 3 rows. After that the appendpipe/stats is then calculating the totals for each class based on the values of those 3 rows.
Hope this helps.