I need to get sum of totalrevenue where churn=1.
I am able to get the count of churn whose churn=1 and total count of chur but not for other variable totalrevenue.
Can any one help me out to achieve this
I used the query to get count churn=1 :
| eval CHURN = if(CHURN="1",1,0)
| stats sum(CHURN) as ChurnedCustomers,count(CHURN) as Total_Churn by PLACEMENT
I need the sum(totalrevenue) where churn=1.
I have two variable total revenue and churn. churn has two values 1 and 0.
like in SQL: select sum(totalvariable) from mysourcetable where churn=1
Thank you @vganjare
| eventstats sum(TotalRevenue) as ff by PLACEMENT
| where CHURN="1"
| stats sum(Total_Revenue) by PLACEMENT
using eventstats, all the events are updated with new fields i.e. if you use eventstats sum(Total_Revenue) , then all the events will have same value for sum field. More @ http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Eventstats