I have a lookup table with daily records which includes: area, alarm description, date, number of bags per area and for that specific day (repetitive number). There is a timestamp for each alarm, and a bag column repeating the total bags for that day (same number appears multiple times because the same day has multiple alarm rows). I want to: 1) compute the total number of bags for the whole 3-month period. 2) compute the total number of alarm events (counted as total occurrences across 3 months). What is the best approach in Splunk enterprise to get both in the same final stats result? Example of scenario: AREA ALARM DESCRIPTION TOTAL DAILY BAGS TIME 1111 TRIGGER 18600 01/03/2024 1111 TRIGGER 18600 01/03/2024 1222 FAILURE 18600 01/03/2024 1323 FAILURE 18600 01/03/2024 1323 HAC 18600 01/03/2024 1222 FAILURE 33444 01/02/2024 1111 FAILURE 33444 01/02/2024 1323 TRIGGER 33444 01/02/2024
... View more