I've got a splunk query that has a bunch of columns, that have the value 1 or 0, for each record in the result set.
e.g.
hasWidth | hasHeight | isEnabled |
---|---|---|
1 | 1 | 1 |
0 | 0 | 1 |
1 | 0 | 1 |
I'd like to run a splunk query that sums up those columns in a table, e.g.
hasWidthCount | hasHeightCount | isEnabledCount |
---|---|---|
2 | 1 | 3 |
How can I do this?
You can do this by using stats and sum for each field
| stats sum(hasWidth) as hasWidthCount, sum(numExpiringToday) as numExpiringCount, sum(isEnabled) as isEnabledCount