Sum or count by same value

[rsokolova]

Thanks in advance.

We are trying to sum two values based in the same common key between those two rows and for the ones missing a value should be considered as a cero, to be able to sum both fields (eval Count=Job_Count + Request_Count) .

Expected result should be:
PO_Ready Count
006341102527 5
011561102529 5
011971102529 6
012381102528 5

[gcusello · Accepted solution]

Hi rsokolova,
If you always have only one between Job_Count and Request_Count, you can try something like this:

your_search
| eval Count=coalesce(Job_Count,Request_Count)
| stats sum(Count) AS Count BY PO_Ready 

otherwise if you have for a PO_Ready both Job_Count and Request_Count, you can try something like this:

your_search
| stats sum(Job_Count) AS Job_Count sum(Request_Count) As Request_Count BY PO_Ready 
| eval Count=Job_Count + Request_Count 
| table PO_Ready Count

Bye.
Giuseppe

[rsokolova]

Thanks cusello for the quick reply the coalesce command did the trick.