Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Sum of count conditionally within a query

$
0
0
I have incoming calls and I'm trying to get total number of calls followed by sum of calls where the field "result" equals declined, caller_ended, or callee_ended. I'm able to get the sum(count) but for the second part I am only getting a count of the events when really I want to sum the count. How can I get a sum of the field count where result is equal to "callee_ended", "caller_ended" or "declined" without filtering the first part of the query |stats sum(count) as NumberofCalls , sum(eval(if((result = "declined" OR result = "caller_ended" OR result = "callee_ended"), count, NULL))) AS SuccessfulCalls

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>