Stats sum function

[Michael_Schyma1]

index=hig `sourcetype="MainframeApps"  |stats sum(count)|top limit=0  app_id app_name | fields + count, total_count,  percent,app_name, app_id | accum count AS total_count | rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"

I can not figure out why i can not get the sum function to work? any suggestions

[lguinn2]

I think you just want

stats count

But I also think that you misunderstand how the Splunk command pipeline works. At each step of the pipeline, the intermediate results are transformed. After you run stats count in the pipeline, the fields app_name and app_id are no longer available to you, as they are no longer included in the intermediate results.

Try this search instead:

index=hig sourcetype="MainframeApps" 
| stats count by app_id app_name
| eventstats sum(count) as total_count
| eval percent = round(count*100/total_count,1)
| rename total_count AS "Total Count" app_id AS "App Code" app_name AS "Application Name" count AS "Number of Events" percent AS "Percent"

[lguinn2]

Nice - I forgot about the limit=0 on the top command.

[gkanapathy]

or just
index=hig sourcetype=MainframeApps | top limit=0 app_id app_name