Splunk Search

## What does "stats sum(count) by" do?

Communicator

Hey, a really basic question, but I'm unsure of the answer. What does `stats sum(count) by` do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does `stats sum(count)` do? I've looked for a while and can't figure out what it does.

Tags (3)
1 Solution SplunkTrust

Before this stats command, there are fields called count and foo (there could be other fields). The command `stats sum(count) by foo` generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field) SplunkTrust

Before this stats command, there are fields called count and foo (there could be other fields). The command `stats sum(count) by foo` generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)

Communicator

So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)?   