Search code examples
splunksplunk-query

Splunk - how to sum up lots of different columns?


I've got a splunk query that has a bunch of columns, that have the value 1 or 0, for each record in the result set.

e.g.

hasWidth hasHeight isEnabled
1 1 1
0 0 1
1 0 1

I'd like to run a splunk query that sums up those columns in a table, e.g.

hasWidthCount hasHeightCount isEnabledCount
2 1 3

How can I do this?


Solution

  • You can do this by using stats and sum for each field

    | stats sum(hasWidth) as hasWidthCount, sum(numExpiringToday) as numExpiringCount, sum(isEnabled) as isEnabledCount