Splunk Search

rename and add 2 count results

Rajaion
Path Finder

Hello community,

I'm having a problem with a probably stupid addition but I can't find a solution. I make a simple query which returns me an account using a field called "routingKey":

Rajaion_1-1718024203766.png

However, in this example I have duplicate routingKey but with different names (example: routingdynatrace_2 and dynatrace_2 are actually the same source). This is due to a change in the way I collect my data and this has changed the name of the routingKey. The data is however not the same (the data of the routingKey "routingdynatrace_2" is not the same as "dynatrace_2")

My question is: how do I add two RoutingKey after the count to get the overall total? I tried to rename the routingKey upstream but the query does not add them after renaming.

If you have any ideas, I'm interested.

Sincerely,

Rajaion

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| eval routingkey=if(routingkey="routingdynatrace_2","dynatrace_2",routingkey)
| stats sum(count) as count by routingkey

Rajaion
Path Finder

Thanks for your help, it's work

0 Karma
Get Updates on the Splunk Community!

Incident Response: Reduce Incident Recurrence with Automated Ticket Creation

Culture extends beyond work experience and coffee roast preferences on software engineering teams. Team ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 2)

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Index This | I am a number but I am countless. What am I?

January 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  Happy New Year! We’re ...