- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: What does "stats sum(count) by" do?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey, a really basic question, but I'm unsure of the answer. What does stats sum(count) by do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does stats sum(count) do? I've looked for a while and can't figure out what it does.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)?
Thank you for your help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That is correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great thank you, you really helped me out!
Updated Team Landing Page in Splunk Observability
New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...
Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...
