Search code examples
splunksplunk-query

Splunk : How to sum the values of the fields that are a result of if condition

My Aim :

This below query gives me count of success, failure by b_key. I want to now get the sum of all success and failures as shown in the image below. Also I want to count the number of b_key for which the failure occured. In the example below it will be 2.

enter image description here

Query :

| stats dc(test_events) as events by a_key,b_key
| eval status = if(events=2,"Success","Failure") 
| chart count over b_key by status
Solution

  • Use the addcoltotals command to create the "Sum" field.

    | stats dc(test_events) as events by a_key,b_key
| eval status = if(events=2,"Success","Failure") 
| chart count over b_key by status
| addcoltotals labelfield=b_key label="Sum"