Splunk Search

What does "stats sum(count) by" do?

Communicator

Hey, a really basic question, but I'm unsure of the answer. What does stats sum(count) by do? I'm fairly sure that the -- by field -- part aggregates the results of stats sum(count) by the field given. But what does stats sum(count) do? I've looked for a while and can't figure out what it does.

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)

View solution in original post

SplunkTrust
SplunkTrust

Before this stats command, there are fields called count and foo (there could be other fields). The command stats sum(count) by foo generates a new field with name "sum(count)" with sum of field "count" with grouping by field foo. (sum is aggregation function and count is existing field)

View solution in original post

Communicator

So the new field with name "sum(count" a value equal to the sum of the field count? So if count had values: 1, 2, and 3, then this "sum(count)" field will have a value of 6 (1+2+3)?
Thank you for your help!

0 Karma

SplunkTrust
SplunkTrust

That is correct.

Communicator

Great thank you, you really helped me out!

0 Karma