Splunk Cloud Platform

How to use stats sum and stats count by in Single command?

kalaiyarasi
Loves-to-Learn Lots

Hi,

I have below fields in which i need to display the count of each field value
|eval TotalApps=if(match('Type'="NTB"),"1","0")

|eval InProgress=if(Type= "NTB" AND isnull(date),"1","0")

|eval Submitted=if(Type= "NTB" AND isnotnull(date),"1","0")
|eval Apps_Submitted=if(match('Myinfo_Used',"1"),'REASON_CD',"0")
|stats count by Apps_Submitted

getting results as

COPS   1

CMS   2

FCO   3

but requirement is

|stats sum(TotalApps) as TotalApps sum(InProgress) as InProgress sum(Submitted) as  Submitted (along with the AppsSubmitted count of each field value)

Eg:

TotalApps    10

InProgress   5

Submitted   5

AppsSubmitted  5

COPS       1

CMS         2

FCO          3

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample events in a code block </> so we can see what you are dealing with.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...