Splunk Search

rename and add 2 count results

Rajaion
Path Finder

Hello community,

I'm having a problem with a probably stupid addition but I can't find a solution. I make a simple query which returns me an account using a field called "routingKey":

Rajaion_1-1718024203766.png

However, in this example I have duplicate routingKey but with different names (example: routingdynatrace_2 and dynatrace_2 are actually the same source). This is due to a change in the way I collect my data and this has changed the name of the routingKey. The data is however not the same (the data of the routingKey "routingdynatrace_2" is not the same as "dynatrace_2")

My question is: how do I add two RoutingKey after the count to get the overall total? I tried to rename the routingKey upstream but the query does not add them after renaming.

If you have any ideas, I'm interested.

Sincerely,

Rajaion

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

Rajaion
Path Finder

Thanks for your help, it's work

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...