Splunk Search

rename and add 2 count results

Rajaion
Path Finder

Hello community,

I'm having a problem with a probably stupid addition but I can't find a solution. I make a simple query which returns me an account using a field called "routingKey":

Rajaion_1-1718024203766.png

However, in this example I have duplicate routingKey but with different names (example: routingdynatrace_2 and dynatrace_2 are actually the same source). This is due to a change in the way I collect my data and this has changed the name of the routingKey. The data is however not the same (the data of the routingKey "routingdynatrace_2" is not the same as "dynatrace_2")

My question is: how do I add two RoutingKey after the count to get the overall total? I tried to rename the routingKey upstream but the query does not add them after renaming.

If you have any ideas, I'm interested.

Sincerely,

Rajaion

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

Rajaion
Path Finder

Thanks for your help, it's work

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...