Splunk Search

how to count values from a filed and show count as column

siddhardhans
Explorer

i am running below query to get total count by date_mday.


search query | eval ver=substr(av,1,4) | stats count(ver) by date_mday

and getting results for total count by month day. 

date_mdaycount
123
225
335
421

 

However, i want the results as ver count and total count - something like

date_mdayver1234ver2345ver3456ver4567total Count
110201123
2952925
311741335
48021121

 

Since eval (eval ver=substr(av,1,4)) is dynamically populating the values to ver - I can't use | stats count(eval()) function. Please help me out.

Labels (2)
0 Karma
1 Solution

DalJeanis
Legend

Try this

 

search query 
| eval ver=substr(av,1,4)
| chart count by date_mday ver
| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

 

View solution in original post

0 Karma

DalJeanis
Legend

Try this

 

search query 
| eval ver=substr(av,1,4)
| chart count by date_mday ver
| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

 

0 Karma

siddhardhans
Explorer

@DalJeanis  this is great - any suggestion to get total count on these dynamic columns?

0 Karma

DalJeanis
Legend

 

| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

The addtotals command will add up the totals horizontally, the addcoltotals will add them vertically.

I've updated the code above to include these.

 

0 Karma

siddhardhans
Explorer

@DalJeanis - thank you so much - i am able to see the table the way i needed. 

Tags (1)
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...