Splunk Search

Sum or count by same value

rsokolova
Path Finder

Thanks in advance.

We are trying to sum two values based in the same common key between those two rows and for the ones missing a value should be considered as a cero, to be able to sum both fields (eval Count=Job_Count + Request_Count) . alt text

Expected result should be:
PO_Ready Count
006341102527 5
011561102529 5
011971102529 6
012381102528 5

Tags (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi rsokolova,
If you always have only one between Job_Count and Request_Count, you can try something like this:

your_search
| eval Count=coalesce(Job_Count,Request_Count)
| stats sum(Count) AS Count BY PO_Ready 

otherwise if you have for a PO_Ready both Job_Count and Request_Count, you can try something like this:

your_search
| stats sum(Job_Count) AS Job_Count sum(Request_Count) As Request_Count BY PO_Ready 
| eval Count=Job_Count + Request_Count 
| table PO_Ready Count

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi rsokolova,
If you always have only one between Job_Count and Request_Count, you can try something like this:

your_search
| eval Count=coalesce(Job_Count,Request_Count)
| stats sum(Count) AS Count BY PO_Ready 

otherwise if you have for a PO_Ready both Job_Count and Request_Count, you can try something like this:

your_search
| stats sum(Job_Count) AS Job_Count sum(Request_Count) As Request_Count BY PO_Ready 
| eval Count=Job_Count + Request_Count 
| table PO_Ready Count

Bye.
Giuseppe

rsokolova
Path Finder

Thanks cusello for the quick reply the coalesce command did the trick.

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...