Splunk Search

How to calculate sum of two field values?

leujinlove
Explorer

I got a search result as below.

ClientType count


SI 130
Competotor1 115
Partner 70
Competotor2 20

However, I like to change the result, as sum of the count values of Competotor1 and Competotor2 is Competotor_total and delete the values of Competotor1 and Competotor2.
The changed result will be

ClientType count


Competotor_Total 135
SI 130
Partner 70

Could anyone help me how to do that?

Best Regards.

Tags (3)
0 Karma
1 Solution

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

View solution in original post

vasanthmss
Motivator

Try this

| eval new_ClientType =if(ClientType LIKE "%Comp%", "Competotor_Total",ClientType ) | stats sum(count) by new_ClientType

V

leujinlove
Explorer

Thanks to you, I could understand 'eval if' function.
Thanks a lot.

0 Karma

neeldesai1992
Path Finder

But how did you add two functions?

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...