Splunk Search

Adding Field Values Generated by a |stats latest(fieldvalue) command

jason_hotchkiss
Path Finder

Hello -

 

I have the following search:

<base search>
| fields host registrations
| stats latest(registrations) by host

This produces the following table:

host       latest(registrations)
Pc1        51

Pc2        29

Pc3        18

How would I add the values of latest(registrations) to provide a single value for all 3 hosts?  For example, I would like only the sum of the latest registrations (98) to display in a single value panel.

 

Thank you!

Labels (3)
0 Karma
1 Solution

ITWhisperer
Legend
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg

View solution in original post

0 Karma

ITWhisperer
Legend
<base search>
| fields host registrations
| stats latest(registrations) as latest_reg by host
| stats sum(latest_reg) as total_latest_reg

View solution in original post

0 Karma

jason_hotchkiss
Path Finder

Thank you!!  This worked for me.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!