Is there any function works like group by grouping sets in Mysql?

[krim]

is there any function works like group by grouping sets in Mysql?
So that I can get a value from each group and a total one

[bowesmana]

The stats XXX by YYY will do aggregations to group by YYY and you can include more than one field to group by.

Can you explain a bit more exactly what you are trying to do with the data you have

[krim]

select

coalesce(class,"total") as class,

coalesce(name,"total") as name,

sum(num) as sum

from table a
group by grouping sets (class,name,(class,name))

In mysql I can get sum from each group and a total at the same time, from the left table to the right one. 

can I do the same in Splunk?

[bowesmana]

The answer is always YES with Splunk 😀 and often there is more than one way to achieve the same result.

Here is an example with your data setup (note that in your data example, your C2/C sum is shown as '3' in the right table, however, from the data in the left, it should be 4, right?

| makeresults
| eval _raw="Class,name,number
C1,A,1
C1,B,2
C2,C,1
C1,A,1
C1,B,2
C2,C,3"
| multikv forceheader=1 

| table Class,name,number

| stats sum(number) as sum by Class name
| addcoltotals labelfield="Class"
| appendpipe [
  | stats sum(sum) as sum by Class
]

so in this example, up to multikv is setting up the sample data from your left hand table, then:

the first stats sum... is calculating the totals by Class/name to give you 3 rows. Then addcoltotals is giving the total for those 3 rows. After that the appendpipe/stats is then calculating the totals for each class based on the values of those 3 rows.

Hope this helps.