Splunk Search

the function sum(count) by xx field is not working

umsundar2015
Path Finder

For me the below stats sum(count) by Asset_status provies no results .

eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats sum(count) by Asset_status

Asset_status sum(count)
Desktop

Others

Server

May i please know the reason for this and how can i get the sum of counts values.

Tags (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

stats sum(count) is not needed. just stats count is fine.

    |stats count by Asset_status

eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status 
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

stats sum(count) is not needed. just stats count is fine.

    |stats count by Asset_status

eval Asset_status= if(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server",if( Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop","Others"))|stats count by Asset_status 
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi Umsundar, may i know if this issue got resolved, can you please mark it as accepted answer..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

cmerriman
Super Champion

also, you can use case instead of a nested if

...|eval Asset_status= case(Asset_Class=Server OR Asset_Type_Name=Server OR Asset_Class="" ,"Server", Asset_Class="eskto" OR Asset_Type_Name=Computer OR Asset_Type_Name="","Desktop",1=1,"Others")|stats count by Asset_status
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...