Hi.
I have 4 events with field _smsresult=_ , and I have to calculate the amount of the values of this field. I tried to use<code> stats sum(SMSRESULT) </code>
The problem is that some events absolutely same and splunk ignore repeated values.
For example sum of
<pre>
... smsresult=9
... smsresult=9
... smsresult=1
... smsresult=9</pre>
returns me not 38, but 10.
What I have to do to fix this?
↧