Splunk Search

how to count values from a filed and show count as column

siddhardhans
Explorer

i am running below query to get total count by date_mday.


search query | eval ver=substr(av,1,4) | stats count(ver) by date_mday

and getting results for total count by month day. 

date_mdaycount
123
225
335
421

 

However, i want the results as ver count and total count - something like

date_mdayver1234ver2345ver3456ver4567total Count
110201123
2952925
311741335
48021121

 

Since eval (eval ver=substr(av,1,4)) is dynamically populating the values to ver - I can't use | stats count(eval()) function. Please help me out.

Labels (2)
0 Karma
1 Solution

DalJeanis
Legend

Try this

 

search query 
| eval ver=substr(av,1,4)
| chart count by date_mday ver
| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

 

View solution in original post

0 Karma

DalJeanis
Legend

Try this

 

search query 
| eval ver=substr(av,1,4)
| chart count by date_mday ver
| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

 

0 Karma

siddhardhans
Explorer

@DalJeanis  this is great - any suggestion to get total count on these dynamic columns?

0 Karma

DalJeanis
Legend

 

| addtotals fieldname="Total Count"
| addcoltotals labelfield=date_mday label="All Days"

 

The addtotals command will add up the totals horizontally, the addcoltotals will add them vertically.

I've updated the code above to include these.

 

0 Karma

siddhardhans
Explorer

@DalJeanis - thank you so much - i am able to see the table the way i needed. 

Tags (1)
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...